The Adobe Flash zero-day exploit that spyware developer Hacking Team made available to customers worked successfully against even the advanced defenses found in Google's Chrome browser, researchers said Friday. They also noted that it was used to infect computer users multiple times before it was leaked.
Google developers patched the underlying Flash vulnerability in Chrome on Tuesday (for proof, use enter about:version in the address bar and note the Flash version), and Adobe published a general fix a day later.
The leak of the previously unknown exploit resulting from the devastating hack of Hacking Team last weekend and exploit kits available on the black market quickly added attack code to use the flaw. It allows attackers to surreptitiously install malware on targets' computers, and there's evidence that before last weekend's breach, Hacking Team customers used the Flash zero-day against live targets.
A testament to the reliability of the exploit: it worked against Google Chrome, which has long been considered the most hardened general-purpose browser thanks to its state-of-the-art security sandbox. This should cordon off sensitive operating-system functions from content available online.But in a blog post published Friday by security firm Cybereason, company researchers wrote, "For one target based in Egypt, we were able to see that they were using Chrome build 43.0.2357.130, which was released on June 22. Hacking Team infiltrated their system using the Flash exploit just six days later on June 28. This is both important and amusing, considering Chrome is marketed as the most secure browser for the average user, but they were able to exploit it in a matter of days after the most recent update at the time."
Friday's blog post doesn't say exactly how the exploit was able to break out of the Chrome sandbox, but a likely possibility is that the Adobe exploit was bundled with a separate piece of attack code exploiting a previously unknown flaw in Windows, as Ars reported Tuesday. Such escalation-of-privilege exploits are frequently used in combination with other exploits to pierce sandboxes found in Chrome and other applications. Microsoft has yet to publicly acknowledge the vulnerability; Ars has asked company officials to comment and will update this post if they respond.
Update: Microsoft officials have issued the following statement: "We believe the overall risk for customers is limited, as this vulnerability could not, on its own, allow an adversary to take control of a machine. We encourage customers to apply the Adobe update and are working on a fix."
Separately, researchers from security firm Trend Micro unearthed evidence the Flash exploit Hacking Team sold was used in highly targeted attacks against people in Korea and Japan. The exploit, which was triggered when targets visited a booby-trapped website, remotely downloaded an encrypted file onto the target's computer, where it was then executed.
"We believe this attack was generated by Hacking Team’s attack package and code," the Trend Micro blog stated. "From a purely engineering perspective, this code was very well written. Some attackers may be able to learn how to deploy and manage targeted attacks to different victims from the leaked code."
The Cybereason researchers echoed the concern about general release of government-grade malware and exploit code.
"The widespread availability of this data is going to empower hacking teams across the globe, providing them with much more sophisticated techniques to launch their own attacks," they wrote. "These newer operations will have a completely different signature than Hacking Team’s efforts, but because of how detailed the information on their delivery server is, with perfectly readable code and extremely detailed comments, we can assess the behavior these attacks will follow and more accurately and quickly identify these operations in the future."
Listing image by Wikipedia
reader comments
72