BlackOasis APT and new targeted attacks leveraging zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-5119 | Use-After-Free RCE in Adobe Flash Player (ActionScript 3 ByteArray) CVE-2015-5119 is a use-after-free memory-corruption vulnerability (CWE-119) in the ActionScript 3 ByteArray class of Adobe Flash Player. It is triggered when Flash processes crafted ActionScript/SWF content — typically a malicious .swf loaded from a web page, advertisement, email attachment, or document — causing Flash to access already-freed memory in an attacker-controllable way. A successful attack gives the adversary remote code execution in the context of the user running Flash. Anyone with Adobe Flash Player installed was exposed; at disclosure Flash was on the vast majority of internet-connected desktops, and today risk is concentrated in legacy browsers, office/document tooling, industrial or enterprise applications, and other systems where Flash was never removed. Exploitation status: this flaw has long-standing in-the-wild use (related headlines tie the leaked Hacking Team Flash exploit to APT campaigns against Japanese, East Asian, and US Government targets and to top 2016 exploit kits), it is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03; ransomware use unknown), and EPSS assigns a 99.3% probability of exploitation within 30 days. Do: Because Flash Player is end-of-life, CISA's required action is to disconnect it rather than patch: audit browsers, document/office tooling, and legacy or industrial applications for Flash dependencies and fully uninstall or disable Flash and any embedded SWF players. If a system must keep Flash temporarily, verify it runs a patched build from 2015 or later (Adobe's July 2015 emergency update, APSB15-16, addressed this flaw) and block untrusted SWF content via browser settings, email gateway, and web filtering. Prioritize cleanup on internet-facing endpoints and users who browse the web or open untrusted email attachments, the typical delivery route for this exploit. | — | 99% | KEV |
| mass≈ millions of legacy desktop installations | |
| CVE-2016-0984 | Use-After-Free RCE in Adobe Flash Player and AIR Adobe Flash Player and Adobe AIR contain a use-after-free memory corruption flaw (CWE-416) that allows remote attackers to execute arbitrary code by persuading a user to load specially crafted Flash content, as the CVSS vector (AV:N/UI:R) indicates exploitation via user interaction such as opening a malicious SWF in a browser or an application embedding Flash/AIR. Successful exploitation gives the attacker code execution with the victim user's privileges, with high impact on confidentiality, integrity, and availability. All Flash Player versions before 18.0.0.329, 19.x/20.x before 20.0.0.306 on Windows and OS X, and before 11.2.202.569 on Linux are affected, along with Adobe AIR Desktop Runtime, AIR SDK, and AIR SDK & Compiler before 20.0.0.260. The flaw was fixed in February 2016 as one of several sibling use-after-free bugs (CVE-2016-0973, -0974, -0975, -0982, -0983), and a public proof of concept is available (Exploit-DB 39462). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, confirming known in-the-wild exploitation (ransomware use unknown), and EPSS at 54.8% (99th percentile) indicates continued likelihood of exploitation against remaining exposed systems. Do: Upgrade Flash Player to 18.0.0.329, or 20.0.0.306 on Windows/macOS and 11.2.202.569 on Linux, and upgrade AIR, AIR SDK, and AIR SDK & Compiler to 20.0.0.260. Because Flash is end-of-life, per CISA KEV guidance the preferred action is to remove or disable Flash entirely and disconnect any system still running it; audit legacy browsers, kiosks, industrial HMIs, and embedded apps that still load SWF content, since exploitation requires user-opened Flash content. | 8.8 | 55% | KEV PoC |
| massApproximately 1 billion+ installations at the time of disclosure (Flash was installed on the vast majority of internet-connected PCs in early 2016); current… | |
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier CVE-2016-4117 is a critical (CVSS 3.1: 9.8) arbitrary code execution vulnerability in Adobe Flash Player 21.0.0.226 and earlier, in which unspecified vectors in the Flash runtime allow remote attackers to execute arbitrary code. It is triggered by delivering malicious Flash content over a network — for example a crafted SWF loaded by a browser or an application that embeds Flash — and, per its CVSS scoring, requires no privileges or authentication. A successful exploit gives the attacker code execution in the context of the Flash runtime (typically the user's browser process), which public reporting shows was used to deliver espionage tooling and, per CISA, is also known to be used in ransomware campaigns. Anyone running Flash Player 21.0.0.226 or earlier was affected, including users of the flash-player packages shipped for Red Hat Enterprise Linux Desktop, Server (including the RHUI variant) and Workstation, openSUSE, openSUSE Evergreen, and SUSE Linux Enterprise Desktop and the SUSE Linux Enterprise Workstation Extension. The bug was exploited in the wild in May 2016 — related headlines tie it to the BlackOasis APT 'Operation Daybreak' espionage campaign using FinFisher — and it was added to the CISA KEV on 2022-03-03 with known ransomware use and a very high 94.4% EPSS. Do: Per CISA's required action, Flash Player is end-of-life: remove or disable Flash wherever it is still present and uninstall the flash-player packages on any remaining RHEL, SUSE or openSUSE hosts, especially internet-facing systems. If a legacy system must keep Flash, ensure it runs a release later than 21.0.0.226 (a fixed build from the May 2016 Adobe update or later) and restrict it from untrusted web content. | 9.8 | 94% | KEV ransomware PoC |
| mass≈100M+ desktop users at the time of disclosure (Flash was then near-universal); residual small base of end-of-life installs today | |
| CVE-2017-11292 | Type Confusion in Adobe Flash Player 27 Allows Arbitrary Code Execution Adobe Flash Player 27.0.0.159 and earlier contains a flawed bytecode verification procedure (CWE-843, type confusion) that lets an untrusted value be used to compute an array index, corrupting object types in the Flash runtime. The flaw is triggered when a user views attacker-crafted Flash (SWF) content — for example embedded in a malicious document or webpage — since the attack vector is network-based with user interaction required and no privileges needed. Successful exploitation yields arbitrary code execution in the context of the Flash process, typically giving the attacker code execution on the endpoint with the current user's rights. Anyone still running Flash Player 27.0.0.159 or earlier is affected, including the Desktop Runtime and the Flash plugin bundled in Red Hat Enterprise Linux Desktop, Server, and Workstation environments; the product has since reached end-of-life. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-03-03 (ransomware use unknown), related headlines tie it to the October 2017 BlackOasis APT zero-day attacks, and EPSS assigns an ~12% probability of exploitation in the next 30 days (96th percentile). Do: Uninstall or disconnect Adobe Flash Player everywhere it is still present — the product is end-of-life and CISA's required action is to disconnect impacted systems still in use. If Flash must temporarily remain (e.g., Red Hat Enterprise Linux systems using the supplementary Flash plugin or legacy desktops), ensure it runs a release later than 27.0.0.159 and block SWF content in browsers, email, and Office documents. Hunt for residual Flash installs, browser plugins, and embedded .swf content before decommissioning. | 8.8 | 12% | KEV |
| mass~1 billion active Flash users at the time of disclosure; today only residual legacy installs remain, plausibly hundreds of thousands to millions of systems | |
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) CVE-2017-8759 is a code injection flaw (CWE-94) in Microsoft .NET Framework's handling of SOAP WSDL parsing, in which untrusted content referenced by a document or application is parsed and used during object instantiation, allowing attacker-controlled code to run. An attacker triggers it by delivering a specially crafted document — notably a Microsoft Word file referencing a malicious WSDL URL — and gets code execution when the document is opened and .NET downloads and parses the referenced content. Successful exploitation gives the attacker code execution with the privileges of the current user, sufficient to install malware, steal data, or facilitate further compromise. Any Windows system running .NET Framework versions 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, or 4.7 is affected, which at disclosure covered the vast majority of Windows desktops and servers in use. The flaw was a zero-day exploited in the wild at disclosure (September 2017, used in targeted attacks including BlackOasis), is listed in CISA's Known Exploited Vulnerabilities catalog, and public proof-of-concept exploits are available. Do: Apply Microsoft's security updates addressing this vulnerability to all affected .NET Framework versions on Windows endpoints and servers, per the CISA KEV required action. Prioritize user-facing systems that open documents and are internet-exposed, and verify installed .NET Framework versions before and after remediation. As a compensating control, exercise caution with untrusted documents and block or inspect outbound fetches of WSDL references embedded in Office files. | 7.8 | 89% | KEV PoC ×2 |
| masshundreds of millions of Windows devices (affected .NET Framework versions were enabled by default across broadly deployed Windows client and server releases) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 21.0.0.226 | d of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chr |
| md5 | 4a49135d2ecc07085a8b7c5925a36c0a | d – mo.exe As mentioned earlier, the “mo.exe” payload (MD5: 4a49135d2ecc07085a8b7c5925a36c0a) is the newest version of FinSpy malware, typically sold to |
| url | http://89.45.67[ | nitial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf. Second stage shellcode The second |
Full article1,288 words · extracted from securelist.com · click to collapse
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: [email protected]
Introduction
Kaspersky Lab has always worked closely with vendors to protect users. As soon as we find new vulnerabilities we immediately inform the vendor in a responsible manner and provide all the details required for a fix.
On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. The exploit was delivered through a Microsoft Office document and the final payload was the latest version of FinSpy malware. We have reported the bug to Adobe who assigned it CVE-2017-11292 and released a patch earlier today:
So far only one attack has been observed in our customer base, leading us to believe the number of attacks are minimal and highly targeted.
Analysis of the payload allowed us to confidently link this attack to an actor we track as “BlackOasis”. We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017. The FinSpy payload used in the current attacks (CVE-2017-11292) shares the same command and control (C2) server as the payload used with CVE-2017-8759 uncovered by FireEye.
BlackOasis Background
We first became aware of BlackOasis’ activities in May 2016, while investigating another Adobe Flash zero day. On May 10, 2016, Adobe warned of a vulnerability (CVE-2016-4117) affecting Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. The vulnerability was actively being exploited in the wild.
Kaspersky Lab was able to identify a sample exploiting this vulnerability that was uploaded to a multi scanner system on May 8, 2016. The sample, in the form of an RTF document, exploited CVE-2016-4117 to download and install a program from a remote C&C server. Although the exact payload of the attack was no longer in the C&C, the same server was hosting multiple FinSpy installation packages.
Leveraging data from Kaspersky Security Network, we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time. Those include CVE-2015-5119 and CVE-2016-0984, which were patched in July 2015 and February 2016 respectively. These exploit chains also delivered FinSpy installation packages.
Since the discovery of BlackOasis’ exploitation network, we’ve been tracking this threat actor with the purpose of better understanding their operations and targeting and have seen a couple dozen new attacks. Some lure documents used in these attacks are shown below:
Decoy documents used in BlackOasis attacks
To summarize, we have seen BlackOasis utilizing at least five zero days since June 2015:
- CVE-2015-5119 – June 2015
- CVE-2016-0984 – June 2015
- CVE-2016-4117 – May 2016
- CVE-2017-8759 – Sept 2017
- CVE-2017-11292 – Oct 2017
Attacks Leveraging CVE-2017-11292
The attack begins with the delivery of an Office document, presumably in this instance via e-mail. Embedded within the document is an ActiveX object which contains the Flash exploit.
Flash object in the .docx file, stored in uncompressed format
The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits.
Unpacking routine for SWF exploit
The exploit is a memory corruption vulnerability that exists in the “com.adobe.tvsdk.mediacore.BufferControlParameters” class. If the exploit is successful, it will gain arbitrary read / write operations within memory, thus allowing it to execute a second stage shellcode.
The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files:
NOP sled composed of 0x90 and 0x91 opcodes
The main purpose of the initial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf.
Second stage shellcode
The second stage shellcode will then perform the following actions:
- Download the final payload (FinSpy) from hxxp://89.45.67[.]107/rss/mo.exe
- Download a lure document to display to the victim from the same IP
- Execute the payload and display the lure document
Payload – mo.exe
As mentioned earlier, the “mo.exe” payload (MD5: 4a49135d2ecc07085a8b7c5925a36c0a) is the newest version of FinSpy malware, typically sold to nation states and other law enforcement agencies to use in lawful surveillance operations. This newer variant has made it especially difficult for researchers to analyze the malware due to many added anti-analysis techniques, to include a custom packer and virtual machine to execute code.
The PCODE of the virtual machine is packed with the aplib packer.
Part of packed VM PCODE
After unpacking, the PCODE it will look like the following:
Unpacked PCODE
After unpacking the virtual machine PCODE is then decrypted:
Decrypted VM PCODE
The custom virtual machine supports a total of 34 instructions:
Example of parsed PCODE
In this example, the “1b” instruction is responsible for executing native code that is specified in parameter field.
Once the payload is successfully executed, it will proceed to copy files to the following locations:
- C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe
- C:\ProgramData\ManagerApp\15b937.cab
- C:\ProgramData\ManagerApp\install.cab
- C:\ProgramData\ManagerApp\msvcr90.dll
- C:\ProgramData\ManagerApp\d3d9.dll
The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique. The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution. Once loaded, the DLL will then inject FinSpy into the Winlogon process.
Part of injected code in winlogon process
The payload calls out to three C2 servers for further control and exfiltration of data. We have observed two of them used in the past with other FinSpy payloads. Most recently one of these C2 servers was used together with CVE-2017-8759 in the attacks reported by FireEye in September 2017. These IPs and other previous samples tie closely to the BlackOasis APT cluster of FinSpy activity.
Targeting and Victims
BlackOasis’ interests span a wide gamut of figures involved in Middle Eastern politics and verticals disproportionately relevant to the region. This includes prominent figures in the United Nations, opposition bloggers and activists, and regional news correspondents. During 2016, we observed a heavy interest in Angola, exemplified by lure documents indicating targets with suspected ties to oil, money laundering, and other illicit activities. There is also an interest in international activists and think tanks.
Victims of BlackOasis have been observed in the following countries: Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, Netherlands, Bahrain, United Kingdom and Angola.
Conclusions
We estimate that the attack on HackingTeam in mid-2015 left a gap on the market for surveillance tools, which is now being filled by other companies. One of these is FinFisher with their suite of tools.
We believe the number of attacks relying on FinFisher software, supported by zero day exploits such as the ones described here will continue to grow.
What does it mean for everyone and how to defend against such attacks, including zero-day exploits?
For CVE-2017-11292 and other similar vulnerabilities, one can use the killbit for Flash within their organizations to disable it in any applications that respect it. Unfortunately, doing this system-wide is not easily done, as Flash objects can be loaded in applications that potentially do not follow the killbit. Additionally, this may break any other necessary resources that rely on Flash and of course, it will not protect against exploits for other third party software.
Deploying a multi-layered approach including access policies, anti-virus, network monitoring and allowlisting can help ensure customers are protected against threats such as this. Users of Kaspersky products are protected as well against this threat by one of the following detections:
- PDM:Exploit.Win32.Generic
- HEUR:Exploit.SWF.Generic
- HEUR:Exploit.MSOffice.Generic
More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service. Contact: [email protected]
Acknowledgements
We would like to thank the Adobe Product Security Incident Response Team (PSIRT) for working with us to identify and patch this vulnerability.
References
Indicators of compromise
4a49135d2ecc07085a8b7c5925a36c0a
89.45.67[.]107
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/