Exploit Kit Infects 1.3 Million Computers Through Advertisements

The past six weeks have been about 1.3 million Internet users become infected because they are contaminated classifieds websites visited and had not patched their software. That leaves security firm Trustwave know . The ads redirect users to a new version of the RIG 3.0 exploitkit. This exploitkit uses vulnerabilities in Adobe Flash Player and Windows to infect users with malware. Especially vulnerabilities in Flash Player resulted in a lot of infections.

It is in this case for known vulnerabilities for which updates are available. In total, users would through compromised 3.5 million times ads have been forwarded to the exploitkit, resulting to 1.25 million infections. That equates to an average of 27,000 infections each day and a success rate of 34%. In addition, only traffic from Internet Explorer users redirected to the exploitkit.

Traffic originating from other operating systems and browsers is filtered by the cyber criminals. Once infected computers are then equipped with additional malware such as spambots and ransomware. To protect themselves against this type of attack Trustwave recommends users update their software, and specifically their browser and plug-ins. In addition, the use of click-to-play recommended browsers.

Researchers Develop Worm That Infects Mac Firmware

Researchers have developed a worm that can infect the firmware of Mac computers to infect other Macs again from there. Even if they are not connected to each other via a network. Not only is to detect the attack difficult, but also the prevent or resolve an infection would almost be impossible.

"For most users, this would mean that they should throw away their computer. Most people and organizations do not have the expertise to open their machine and the electronic chip to be reprogrammed," says researcher Xeno Kovah opposite Wired .Kovah conducted with researcher Trammell Hudson investigating the firmware attack. The two will present their findings this week at the Black Hat conference in Las Vegas show.

Vulnerabilities

Firmware, with PCs often referred to as BIOS or UEFI, is essential for the operation of the system, and the first software that is loaded. An infected firmware can survive a new installation of the operating system or replace the hard drive. In the past Kovah discovered along with another researcher for several vulnerabilities in the BIOS of the PC. Now it appears that the same vulnerabilities are also present in Mac computers. "Almost all the attacks we found for PCs also work on the Mac," said Kovah.

The researchers decided to inform Apple. One of the vulnerabilities has been fixed, while another has been partially solved.Three vulnerabilities but are still waiting for an update. Through the vulnerabilities it is then possible to create a worm that can spread unnoticed among MacBooks, say the researchers. Because the worm is beyond the operating system, which will not be noticed. The malware has only seconds to infect the firmware and the attack can be carried out remotely, for example by sending an infected email attachment.

Once infected, the malware can infect the firmware of Thunderbolt devices. These devices will, when connected to another Mac that infect computer. Another problem, according to the investigators that security does not check the contents of firmware. To prevent firmware attacks and advise Hudson Kovah manufacturers allow only signed firmware and firmware updates, and hardware, for example, is equipped with a physical switch that prevents unwanted updating the firmware. The researchers also video below in which the attack is demonstrated.