Recent Poem Flash Leak In Crosshairs Of Cyber Criminals

A critical vulnerability in Adobe Flash Player which ten days ago an emergency patch rolled out is now being actively attacked by cyber criminals. At the time Adobe update rolled out the company claimed that the vulnerability was used only in targeted attacks on a limited scale.

Now reports researcher JuK of the blog Malware do not need Coffee that an exploit of the vulnerability using the Angler-exploitkit added. Consequently have less technical knowledge cybercriminals with the means to attack the Flash leak. The Angler exploitkit was in recent months in large-scale advertising campaigns on popular websites used.

Criminals use this ad network of popular websites to spread infected ads. These ads send visitors unnoticed to a page with the Angler-exploitkit. In case users have their Flash Player or other software is not up-to-date, they can become infected with malware. Now the recent poems Flash leak also been added to the Angler-exploitkit cyber criminals have a greater opportunity to infect internet users, since the update of October 16 may not yet installed anywhere.

In case the attack is successful, the Bedep Trojan is installed on computers. This Trojan can install additional malware, including malware for advertising fraud and ransomware, and the computer part of a botnet. The Flash vulnerability was two weeks before the attack on the 'wild' was discovered already by Google to Adobe reported. Through this page to monitor Internet users whether they are using Flash version.

Adobe Comes Up With New Emergency Patch For Flash Player Flaw

Adobe next week will release an emergency patch for a serious vulnerability in Flash Player that asset is used by attackers to infect computers with malware. The newest vulnerability in the software this week was discovered during attacks in various ministries.

The attacks took place via e-mails containing a link. The link pointed to a website with an exploit that used the vulnerability in Flash Player in order to infect the computer of the target. Adobe has now confirmed that the latest version of Flash Player, version 19.0.0.207, which is indeed a critical vulnerability has been used in a limited number of targeted attacks.

During the week of October 19 will Adobe therefore with an emergency patch to come. The zero-day vulnerability was reported on the very day that Adobe released version 19.0.0.207, where 13 vulnerabilities were fixed. According to anti-malware company Malwarebytes Now is the time to seriously consider switching from Flash Player in the browser or to remove completely from the computer.

Zero-Day Vulnerability In Latest Flash Player Active Attacked

In the latest version of Adobe Flash Player that came out yesterday is a zero-day vulnerability for which no update is available and actively attacked. Reported that the Japanese anti-virus company Trend Micro. Several foreign ministries would be attacked by the leak.

Victims receive a spear phishing email containing a link to a website. This website loads an exploit of the Flash Player flaw uses to install malware on the computer. The emails have subjects like: "Suicide car bomb targets NATO troop convoy in Kabul," "Syrian troops make gains as Putin defends air strikes", "Israel launches airstrikes on targets in Gaza", "Russia warns of response to Reported US nuke buildup in Turkey, Europe "and" US military reports 75 US-trained rebels return Syria ". Visiting such a malicious page with a vulnerable Flash Player is enough to get infected. There is no further interaction is required.

According to Trend Micro, the group behind the attack is also responsible for an attack in which a zero-day vulnerability was used in Java. Also, the group behind attacks on NATO, the White House, the German parliament and foreign ministries sit. The message of the anti-virus company coincides with the Tuesday patch from Adobe. Yesterday released a new version of Adobe Flash Player that 13 vulnerabilities were patched. Yet even Flash Player 19.0.0.207, the latest version now vulnerable to the observed attacks. Adobe would be informed of the new leak, but he has not yet written warning.

American 'Funda' Spread Malware Via Infected Ads

Cyber criminals are again managed to place infected ads on a very popular website with tens of millions of visitors who attempted to install malware. It is Realtor.com, the US counterpart of Funda which all kinds of real estate is offered.

The website is according to market researcher Alexa at the 101st place of most visited websites in the United States and a 485ste place worldwide. It is estimated that Realtor.com monthly 28 million visitors. The attackers previously infected ads on the English website of eBay, Drudge Report and other major websites were seated according to anti-malware company Malwarebytes also behind this attack. Through advertising network Adspirit.net the affected ads were posted on the website.

The ads sent visitors without being noticed this through to a website with the Angler-exploitkit. This exploitkit uses known vulnerabilities include Adobe Flash Player and Internet Explorer to install malware. For whatever it's malware was not disclosed. After being informed, the publisher of Realtor.com and Adspirit off the ads. Internet users whose software was up-to-date were no known risk. Yesterday it became known that criminals a week infected ads on Forbes.com have shown.

Forbes.com Spread Malware Via Infected Adverts

On the very popular website of business magazine Forbes have been infected for some time ads shown to infect visitors with malware tried. Forbes.com state according to market researcher Alexa on the 74th spot of most visited websites in the United States and the 154th place worldwide.

The website is monthly by more than 31 million visited visitors. Those visitors were from 8 to 15 September dished ads so they were undetected to a website with the Angler- and Neutrino-exploit kits. This exploit kits exploit known vulnerabilities include Adobe Flash Player. In case there is no up-to-date software was used silently malware could be installed on the computer, says security firm FireEye.

For what exactly will the malware was not disclosed. The ads were via an advertising service from a third party displayed on the Forbes website. According FireEye use of contaminated advertising remains a popular attack method for criminals.Via advertising platforms, especially those that hold real-time auctions for ad space, attackers can choose exactly where their malicious content is displayed.

In case the infected appear ads on popular websites the chance of massive infection is significantly increased, allowing both users and businesses at risk, according to the security company. After being informed Forbes has removed the infected ads. Last year, even though malware via Forbes.com spread. When attackers used a widget on the website that zero-day vulnerabilities in Internet Explorer and Adobe Flash Player attacked.

Serious Vulnerability In Bugzilla Discovered And Patched

In the Bugzilla system leading software projects like Mozilla, Linux Kernel, Apache Project, Red Hat and Open Office for tracking bugs and vulnerabilities use has discovered a serious vulnerability patched. Using the vulnerability, an attacker could log on to the system and, for instance sensitive bugs and problems see that have not been patched.

It was recently announced it had received an attacker access to the Bugzilla system, Mozilla and so got hold of information on a Firefox vulnerability for which no security was available. This information, the attacker then used to Firefox users to attack. A common method within Bugzilla to provide user access is based on e-mail.

If a user has an email address of a particular organization has he will be considered as a trusted user. In the case of Mozilla involves users who for example an email address @ mozilla.com disposal. The now discovered vulnerability allows an attacker for any domain will create a Bugzilla account, even if they have no access to the e-mail account or domain.

The attacker can then use the created account to log in and depending on the rights given to users of a particular domain are set up access still can not fix bugs and other information. The vulnerability was reported on Monday, September 7th at Mozilla, which is responsible for the development of Bugzilla. On Thursday, September 10th, there appeared an update.

Take offline

Companies Bugzilla in combination with e-mail-based use rights and this update have not yet installed are advised to get the system right offline until the patch is deployed. Also, the logs and user-created lists should be reviewed to see if any users have been created via the vulnerability, so advises PerimeterX, the company that discovered the vulnerability.

Firefox Users Attacked Using Information From Bugzilla

An attacker has certainly been a year of access to the bug system Mozilla and information about at least one unpatched vulnerability in Firefox used to attack users of the open source browser. That Mozilla via a blog posting yesterday disclosed.

Via Bugzilla registers Mozilla bugs and security vulnerabilities in various software projects, such as Firefox and the email client Thunderbird. Access is restricted to certain users. A user who had access to sensitive security information, the password for Bugzilla had also used on another website. This unnamed website was hacked, making the password into hands of the assailant came so access to the Bugzilla account users able to get.

As far as is known, the attacker had this way since September 2014 access to Bugzilla, but there is some evidence to suggest that the attacker since September 2013 on the account logging in. In this time, pushed the attacker information about 185 non-public bugs in Firefox. It is about 110 non-security related bugs, security issues and 53 minor 22 vulnerabilities as "high" or "critical" were labeled. Of these 53 vulnerabilities were patched 43 when she discovered the attacker. Mozilla allows the attacker the information on these 43 vulnerabilities probably can not use it to attack Firefox users.

Zero-Day Flaw

As regards the other 10 vulnerabilities, three of them were respectively 131, 157 and 335 days at the attacker known before appeared a patch. The other seven vulnerabilities were announced less than 36 days. "We think they used this information to attack Firefox users," said Richard Barnes of Mozilla. It is also about zero-day vulnerability patched Mozilla on August 6 and was used sensitive files to steal Firefox users. To the knowledge of Mozilla is not using information about the other nine vulnerabilities. On August 27 there appeared a new Firefox version in which all vulnerabilities were patched where the attacker had access.

Mozilla has decided because of the incident screwing the security of Bugzilla. All users who have access to sensitive security information have the password has been reset and the use of two-factor authentication obligatory. In addition, the number of users with special access restricted and what those users can do. This should make it more difficult for an attacker to gain access to an account and limit the amount of information that can be stolen at a successful attack.

Zero-Day Vulnerabilities In Dolphin And Mercury Browsers For Android

In the Dolpin and Mercury Browsers for Android are vulnerabilities that an attacker could execute arbitrary code on the system or the files can read the browser and for which no update for developers is available.Reported researcher "rotlogix".

Dolphin Browser is installed between 50 million and 100 million times and claims to be the best Android browser. To attack the vulnerability, an attacker must be between the Internet and the user, for example in a wireless network. Then, the attacker must wait until the user downloads a new Dolphin Browser-theme and install. Through themes users can customize the appearance of the browser.

The download takes place over HTTP, allowing an attacker to offer a customized theme. The evil theme then let the attacker run arbitrary code in the context of the browser. The developers of the Dolphin Browser have been notified, but an update is not yet available. Pending the update, users download the advice not new themes in a network environment that they do not manage. Another possibility is to use temporarily a different browser.

Mercury Browser

Another browser for Android where the investigator found problems in the Mercury Browser. This browser has been downloaded between 50,000 and 100,000 times. Through various vulnerabilities in the browser, an attacker can read files in the data directory of the browser and customize it. To carry out the attack, the user must open a specially prepared HTML file. Also in this case, there is still no solution is available. Users also are advised to remove the browser from their device and use an alternative.

32 Zero-Day Vulnerabilities Announced At Black Hat Conference

For another two weeks and then starts the American edition of the Black Hat conference, one of the most important conferences in the field of IT security. This year especially defense against malware and mobile technologies popular topics, but there will also be all sorts of unknown vulnerabilities are demonstrated.

"We have 32 different zero-day vulnerabilities disclosed during the event," said Stevie Wylie, general director of the conference, compared to eWeek . "The zero days come from a variety of areas, including mobile and SCADA (supervisory control and data acquisition) systems." In addition, the conference for the first time a study ( pdf ) published among 460 security experts. The experts suggest that refined attacks directly against the organization are focused and phishing and social engineering are the main concerns. Furthermore, the experts most daily time spent on vulnerabilities that are introduced by their own application developers.

When it comes to expenditure are incidental data leaks that cause end users because they do not follow the policy as well as targeted attacks, the greatest costs. When asked what the weakest link in the enterprise security indicates 33% of the surveyed experts to end users who violate security policy and easily be misled by social engineering attacks. According to Black Hat, the survey shows that the current IT security model of enterprises should be reconsidered and that security professionals do not spend their time and money to make the issues they are most concerned about.

Zero-Day Vulnerability In Microsoft Office Used For Cyber-Espionage

Last Tuesday, Microsoft patched a zero-day vulnerability in Office, which recently has been actively used by a group engaged in cyber espionage. The group sent at least one RTF document on the nuclear negotiations with Iran. The document, which was discovered in Georgia, contained an exploit for a critical vulnerability in Microsoft Office 2013 Service Pack 1 and earlier versions of Office.

Once users opened the paper exploits document was replaced by a genuine document with information on the nuclear negotiations. In the background, however, was installed a backdoor that attackers had full control over the computer, says security firm iSIGHT Partners . According to the company, the group behind the attacks also associated with a recently patched zero-day vulnerability in Java that was also used in targeted attacks.

The group would in April two zero-day vulnerabilities in Flash Player and Windows have used and the recently unveiled Flash exploits which was available to the Italian Hacking Team. The group would have to cater for the collection of military and diplomatic intelligence, although telecoms and defense companies have been targeted. The Office leak that the group is used patched by MS15-070 .

Adobe Flash Player Arming Against New Attacks

Adobe has security measures in collaboration with Google added to Flash Player that should arm the video plug-in against new attacks. In recent months, several different zero-day vulnerabilities found in Flash Player that allows Internet users were attacked.

In this case there was no update available before the attacks took place. In addition, there were dozens of other vulnerabilities discovered in the software that could give an attacker access to computers. A number of these leaks, after the appearance of the update also be used for users of attacks. In this case it was users who did not install the update. A large proportion of the vulnerabilities in Adobe fixes Flash Player detected by Google. The reason is that Google Chrome has an embedded Flash Player. Vulnerabilities in Flash Player can consequently affect Chrome users. In addition, Google has a separate team of hackers that focuses on researching and safer popular software, such as Flash Player.

In addition to reporting new vulnerabilities Google therefore contributes to security. Measures to make it more difficult for attackers to attack vulnerabilities. Along with these measures now from Adobe Adobe Flash Player version 18.0.0.209 implemented. Thus, for example, the memory locations of Flash Player made ​​more random. Because these locations were previously predictable, an attacker could easily use it here. "We think we have put a great step forward when it comes to the security of Flash, but we're not done yet," said Chris Evans of Google.

He stressed that will find a way for every defensive measure attackers to bypass it. "It's a cat-and-mouse game." Evans stressed that the new security measures are effective in 64-bit versions of Flash Player. Users also are advised to upgrade to a 64-bit version of both their browser and Flash Player.

Targeted Attacks On Newly Discovered Java Leak

The Japanese anti-virus company Trend Micro warns of a new critical vulnerability in Java where no update is available for Oracle, which is used in attacks against American defense organization and a member of NATO. According to the virus fighter is about targeted attacks.

That would mean that the vulnerability is not yet widely used to infect home users with malware. For attacking the targets using the assailants emails with a link. The links used by the attackers appear on the left earlier in attacks against NATO members and the White House were deployed, says analyst Li Brooks . In this case the links were encountered in the emails to an American defense organization and a specific NATO member, but who exactly is going does not mean anti-virus company. The link points to a page that tries to make use of the Java leak. In the event that the attack is successful, there is placed on the computer malware.

Vulnerable

The vulnerability is present in the latest Oracle Java version, namely update Java 8 45. Older versions of Java, namely 6 and 7 are not vulnerable. Oracle would have been informed. In anticipation of an update enables users to Java in their browser off or the system removed . A few years ago were regularly called zero-day vulnerabilities found in Java and attacked which no update was available. According to Trend Micro, it is almost two years since the last zero-day Java was reported.

Symantec Confirms Firmware Flaw In Mac Computers

Symantec has confirmed that there is indeed a vulnerability in the firmware of most Mac computers exists that an attacker could install a rootkit to gain persistent root access to the computer. This week, researcher Pedro Vilaca revealed the vulnerability of the EFI firmware.

The problem, which is not present in the latest models of Apple, occurs when the computer wakes from its hibernation, allowing a user to access the firmware. The vulnerability can be used both locally and over the internet. For this last attack, however, would an attacker must have a second vulnerability that provides root access. "Although these vulnerabilities is not widespread, they come from time to time or for", says Symantec .

The anti-virus company says that it is a critical vulnerability, as it may give an attacker root access persistent even erasing the hard drive or it can survive reinstallation of the operating system. Symantec notes that no attacks have been observed in the wild yet, but warns that the risk of seizures increases as the news about the leak from spreading.

Until an update is available, users who think risking the advice to use their computer completely off instead of sleep mode. In addition, it is advisable to keep all the software completely up-to-date, since there is a second leak is necessary in order to attack the vulnerability firmware over the internet. The vulnerability has been confirmed in the Mac Mini 5.1, MacBook Pro 8.2, 9.1 and 9.2, 10.1 Retina MacBook Pro and MacBook Air 5.1. MacBook Pro and MacBook Air 11.3 6.2 would not be vulnerable.

Leak In Older MacBooks Makes Installation Possible Rootkit

A security researcher has discovered a vulnerability in the firmware of several older Apple MacBooks, allowing an attacker could install malware. The latest models do not seem to be vulnerable, but 100% sure researcher Pedro Vilaca not, he tells on his blog.

Vilaca discovered that he is the Unified Extensible Firmware Interface (UEFI) can adjust from "userland". UEFI is the successor to the BIOS and a new model for the interface between the computer's operating system and the platform firmware.The UEFI code should normally be inaccessible to users but the researcher discovered that the code is accessible after a computer is restarted and is in sleep mode.

The problem is in MacBooks for mid-2014 and is mounted on a MacBook Pro Retina MacBook Pro 8.2 and a MacBook Air.Through the vulnerability it is possible to install a rootkit. An attacker does not even have a physical access, since the leak via Safari or attack another attack vector distance is.

The researcher thought that Apple knew of the problem, but that turns out not to be so. So it is a zero-day vulnerability for which no security update Apple has released. Users also are advised to completely turn off their computers and not to put into sleep mode. Vilaca further advises to mail Apple asking for a firmware update.

Zero-day Attack Infected Thousands Flash Users

An attack campaign in late January and early February took place and two zero-day vulnerabilities in Adobe Flash Player made ​​use has infected thousands Flash Users. To attack the leak with Flash User made ​​the cyber criminals use of contaminated ads.

Once a website showed an infected ad, visitors could get infected that had installed Flash Player. In this case the Bedep malware installed on computers. Bedep is a backdoor that gives attackers full control over the computer. While the malware was announced on the attack early this year, the first copies were observed in November last year.

Anti-virus company Trend Micro has identified more than 7,600 victims who were infected with Bedep. The malware does not only make use of vulnerabilities in software, which would also piggyback other software. Most Bedep victims, however, are the result of the zero-day attacks in late January and early February, according to Trend Micro. It is said to be more than half of all infections. Once active Bedep used infected computers to commit fraud and ad click and install additional malware.

EFF Provides Alarm About Effects Of Firmware Malware

The discovery of malware that can modify the firmware of hard drives is a "wake up call" for manufacturers and the security industry that the risk is real and will increase the number of firmware-based attacks. Before that warns the American civil rights movement EFF. The organization argues that even if the problems are not resolved, the consequences "disastrous" can be.

Firmware is the software that runs on all kinds of computer components, such as the video card, network card and hard drive, and makes it possible to control these components. The reason for the cry of the EFF is the discovery of the Equation Group . This group of cyber spies had developed malware that could modify the firmware of all hard drives. The malware could thus reinstall or reformat survive the hard drive. Also made ​​it a hidden container for stolen files on the hard drive and was barely detect .

Firmware is next to computer components in a variety of other electronics available from auto parts to televisions. The big problem with firmware is that the code is closed. Most manufacturers make the source code of their firmware not public. In some cases, they even take steps to counter the "reverse engineer" their firmware. According to Cooper Quintin of the EFF, it is also not possible to see from the computer or the firmware of certain components has been modified or not.

Firmware-based malware is in comparison to other types of malware is still a fairly unexplored area. Attacking the firmware is not only beneficial for cyber spies, but for cybercriminals. The malware would be namely to detect and difficult to remove.Also, most firmware never publicly controlled and closed source code. Thus, according Quintin a "rich source" for zero-day vulnerabilities. Many devices the firmware is not updated, so malware or exploits for a long time may remain.

EFF urges manufacturers also to publish their firmware well as auditing for vulnerabilities and then the results. In addition, firmware updates are digitally signed and finally there should be a mechanism to check the integrity of installed firmware. "We have given up control over our computers. We trust too many different devices. Devices that we should not trust, given that they without us knowing can be compromised," said Quintin.

According to him, it is therefore high time to take control and thus to take back the security. "We need to encourage manufacturers so that they can ensure that their products are reliable, even and especially when they leave the factory floor. We must act now for a future where the foundation of our computers are safe."

Researcher Infected Windows Computers Via Blu-Ray

A researcher at security firm NCC Group has recently shown how using a malicious Blu-ray both Windows computers as Blu-ray players can attack. Stephen Tomkinson gave his demonstration during Secuir-Tay conference in Dundee, Scotland.

The attack that provides the researcher developed using the possibilities Blu-ray. Besides a better picture and sound quality compared to DVD support Blu-ray also many "rich features," such as dynamic menus, embedded games and the ability to download additional information from the internet. These rich features developed by BD-J, a version of Java that works with Xlets. Xlets are similar to the Webapplets that are used on websites. Xlets run in a Java Virtual Machine, which should prevent them from accessing the system.

First Attack:

The first demonstration Tomkinson focused on Cyberlink PowerDVD and how popular media player handles Xlets. A vulnerability in the software makes it possible for you to circumvent the security of the Xlet and execute arbitrary executables. As Blu-ray standard run on systems with PowerDVD, an attacker would through an infected Blu-ray can infect your computer.

Second Attack:

The second attack was directed against a physical Blu-ray player. An Xlet that Tomkinson developed proved to invoke a program on the player who then performed a malicious file from the Blu-ray. This has enabled the researcher to gain root access. In order to leave no potential targets presumption was just shown, the film after performing the attack.

Meanwhile, there would be cooperation with various suppliers to remedy the problems found. "With varying success," Tomkinson says. He advises users in the meantime to disable automatic playback of Blu-ray discs via the AutoPlay feature in Windows. In the case of a physical Blu-ray player users are wise to do that are not connected to the Internet.

Popular Porn RedTube Spread Malware

On the popular porn RedTube researchers have found malicious code that tried to infect visitors with malware. That leaves anti-virus company Malwarebytes know today. Unlike several other porn sites that for "drive-by downloads" were used, there were no infectious ads used in this case. The attackers had direct access to the code of the website.

The malicious code was executed inside an iframe and pointed to the Angler Exploitkit on another page. This exploitkit uses a recently patched vulnerability in Adobe Flash Player. In case users do not use the latest version of Flash Player, they can become infected with a Trojan horse. This malware steals personal information and installs browser helper objects showing ads. Some of these ads pointing again to other operating pages can infect your computer with malware so on.

RedTube leaves in front Malwarebytes know that last Sunday was attacked and the problem was resolved within a few hours.Meanwhile RedTube the malicious code would be removed . The porn is according to measurement agency Alexa on the 128th place of most visited websites on the internet. Earlier today, the anti-virus company warned that the website of chef Jamie Oliver malware spread . Also, this problem has now been resolved.

Hash:
1e0134d9b5b51d9ad233b0a2ecb7cf83

Flash And Unpatched IE Vulnerabilities Used On Forbes.com

Visitors to the popular business magazine Forbes late November attacked via vulnerabilities in Adobe Flash Player and Internet Explorer, which at the time of the attack still no updates were available.According to security iSight Partners and Invincea involved a highly targeted attack.

The attack would be directed cons American defense companies and financial institutions, whose staff Forbes.com visit regularly. The website is according to Alexa on the 68th spot of most visited websites in the US Possible are also other parties and organizations affected by the attack, but it is not yet clear. The same is true for the attack period. Which would have taken place on 28 November to 1 December, but a longer period is not excluded. Besides Forbes would have used several obscure websites for the attack.

The attack took place through the "Thought of the Day" (totd) Adobe Flash widget that appears when someone visits a page or Forbes article. Then, use was made of a zero-day vulnerability in Adobe Flash Player, which eventually on December 9 by Adobe was patched. The attack was combined with a vulnerability in Internet Explorer to bypass the ASLR protection measure in the browser. Bypassing the security measure yesterday evening remedied by Microsoft. How many computers are infected by the attack have both security companies do not know.

Google Reveals Unpatched Vulnerabilities In Mac OS X

After several have leaks in Windows unveiled at a time that no security updates, Google has the same now done with Mac OS X. In total there are three vulnerabilities, allowing an attacker commands as a "system daemon" execute through ' kernel code execution 'root privileges can get or through a Bluetooth device memory corruption can cause.

One of the vulnerabilities has been tested on Mac OS X 10.9.5, while another only at Yosemite is confirmed. Leaks are detected by the "Project Zero Team" of Google, which is looking specifically for vulnerabilities in commonly used software.Once a leak is found will the supplier 90 days to come up with an update, otherwise the details of the vulnerability are automatically made ​​public. Much to the dissatisfaction of Microsoft, which Google called to work better together. Apple has not yet responded to the leak revealed.