Trend Micro: New Flash Vulnerability Same Reason As Earlier Leak

The latest vulnerability in Adobe Flash Player which this week an emergency patch appeared to have the same cause as previous vulnerabilities in the popular browser plug-in. This enables the Japanese anti-virus company Trend Micro after analysis. This week, the vulnerability was with he CVE number 2015-3113 patched after the leak was previously used in targeted attacks. According to researchers, the leak is very similar to CVE-2015-3043 that Adobe patched in April.

Both vulnerabilities cause a buffer overflow. It also appears that an exploit for the vulnerability also published in April version 18.0.0.160 could crash (the latest Flash Player version before the emergency patch released this week). Both vulnerabilities are caused handle FLV with the Nellymoser audio codec and can be attacked through a specially prepared audio tag of an FLV file.

"This incident shows how important it is carefully developing patches to prevent vulnerabilities patched at a later time be attacked again," said the researchers. Which argue that software developers need to perform regression tests to ensure that old bugs are not a threat to new versions of the software.

E-mail

It was already known this week that the attackers left in emails used to lure targets to a malicious page where the Flash Player flaw was then attacked. Security company Websense says that the emails had used the subject line "2015 Program Kick Off". The text stated that the recipient was invited to a meeting. Through the attached link could be found more information about the meeting. The attackers would have mainly focused on the technological and scientific sectors.

Weather Infected Ads On Popular Websites

On several popular websites that get together at least 50 million visitors per month are infected ads have appeared that attempt to install malware. These include CNN to Indonesia, the official site of the Prague airport, RTL Television Croatia and the game Bejeweled Blitz.

The ads will be distributed through the OpenX advertising platform-that in the past has been used frequently for "malvertising". According to Websense , found that the ads make many websites use OpenX installations and are often shared between multiple websites, or is it an advertiser that the technology used on multiple websites.

The infected ads, going around for weeks, using a recently patched vulnerability in Adobe Flash Player. In case users have not installed the update, and the attack is successful, a Trojan horse installed on the computer there. Anti-virus company BitDefender advises Internet users therefore to install a AdBlocker to block these types of infected ads.

Employees IT Company Target Of Malware After Acquisition

Employees of the US IT security company Websense have become the target of malware after the company earlier this week was taken over by the US defense company Raytheon. The workers received an email with the subject "Welcome to join Raytheon" and attach a zip file. The zip file contains the installer of Kaspersky Anti-Virus, plus a DLL.

Once the installation was carried out, was the DLL loaded from the zip file. However, this was the malware. According to Websense it comes to "dll sideloading", also known as "DLL hijacking". A well-known problem that is caused by some of the programs first search in the opened directory to .dll files that are necessary for the execution of the software. An attacker could execute malicious DLL files in this way.

According to Websense, the attack failed because the attackers in their haste had prepared a very sloppy email, without preamble, introduction or explanation. The message consisted of only two sentences, including the password to open the enclosed zip file. "Always use caution with attachments and links in an email and make sure everyone is alert during a takeover. Attackers leave no chance and one click is enough to get infected," said analyst Wang Ulysses.

f0xy Malware: "Malware Hides By Using Microsoft BITS Download Service"

Researchers have discovered a malware specimen that Microsoft's own download service used to hide.The malware by security firm Websense 'f0xy' and is among other because of the use of the Microsoft Background Intelligent Transfer Service ( BITS ).

This service uses available bandwidth for downloading files. Many Windows services use this service, including Windows Update and Windows Defender. According to researchers used f0xy download service to avoid being noticed. Virus scanners would beat slower alarm when network requests BITS see coming than an unknown .exe file would be the case. The malware itself is developed to mine infected computers to digital currency.

Hashes:

f522e0893ec97438c6184e13adc48219f08b67d8

080c61c9172cd49f6e4e7ef27285ccaaf6d5f0ac

c25da337ec5ac041312b062e7fb697e4f01ca8d9

cd4e297928502dece4545acbe0b94dd1270f955c

adbf0e4d37e381fe7599695561262d1a65205317

54d2810aaae67da9fa24f4e11f4c2d5fe4d2b6d4

7de3ed8f751a528fde1688d35c6eb5533b09ae11

812e453c22e1a9f70b605cd27d3f642c3778d96d

55c9d015b1f8d68e6b5ce150f2dbab2b621dac1c

e80d7f27405ece2697a05d6c2612c63335851490

f4f1d8bceb62c72f2fe6713c5395555917fc40ad

2a4837fdb331f823ca474f521248b2cdb766528f

f522e0893ec97438c6184e13adc48219f08b67d8