Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies.
Kafeine, who discovered the exploit, initially believed the attackers had been using a combination of two recently patched Flash Player flaws, but it later turned out to be an unpatched memory leak that could be leveraged to circumvent memory address randomization in Windows. ”Ī different zero-day patched last week by Adobe ( CVE-2015-0310) was seen in the same Angler exploit kit instance. The approach appears to be rapid domain registration and exploitation with quick rotation of domains. “ Based on our telemetry data we have seen domains associated with a single registrar being primarily responsible for the exploits being delivered. Although this spike showed an increase in Angler related attacks, these attacks represent a small minority of the overall attack traffic, ” Cisco researchers explained in a blog post. “There was a spike of traffic utilizing the 0-day beginning on January 20th, all of which were blocked by Cloud Web Security (CWS). In addition to the Angler attacks, CVE-2015-0311 has also been used by cybercriminals in “standalone mode” to distribute a variant of the notorious Reveton ransomware through adult websites, Kafeine said in a blog post. The expert says he has spotted several Bedep samples in this attack, including a variant designed for 64-bit systems.Īccording to the researcher, the attackers are leveraging migsetup.exe, a legitimate component of the Windows Easy Transfer application, to bypass User Account Control (UAC) on infected computers. The flaw has been leveraged by cybercriminals in drive-by download attacks designed to distribute a variant of the Bedep malware, which in this case has been used for ad fraud. Chrome doesn’t appear to be impacted.Īn exploit for this security hole was spotted last week by the French researcher “Kafeine” in an instance of the Angler exploit kit. The vulnerability affects all versions of Internet Explorer and Firefox running on Windows 8.1 and earlier versions of Microsoft’s operating system. “Adobe expects to have an update available for manual download during the week of January 26, and we are working with our distribution partners to make the update available in Google Chrome and Internet Explorer 10 and 11,” Adobe said in an update to its initial advisory for this flaw. The patch was initially announced for this week, but the company released it ahead of schedule.įor the time being, only users who have auto-update enabled will get Flash Player 16.0.0.296, which addresses the critical vulnerability. Adobe updated Flash Player over the weekend to fix the second zero-day vulnerability (CVE-2015-0311) reported last week.
0 kommentar(er)
