Google Accuses Spanish Spyware Vendor of Exploiting Chrome, Firefox, & Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42298 | Microsoft Defender Remote Code Execution Vulnerability Microsoft Defender Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 6% |
| — | ||
| CVE-2022-26485 | Use-After-Free in Mozilla Firefox XSLT Processing Exploited in the Wild CVE-2022-26485 is a use-after-free (CWE-416) in Mozilla Firefox's XSLT handling: if an XSLT parameter is removed while the stylesheet is still being processed, freed memory can be referenced, leading to exploitable memory corruption. An attacker triggers the flaw by getting a user (UI:R per the CVSS vector) to load maliciously crafted web content that invokes XSLT transformation in a vulnerable version of the browser. Successful exploitation could grant the attacker arbitrary code execution in the browser's context with the integrity and confidentiality of the user's data at risk (CVSS 3.1 8.8 High). All users of Firefox below 97.0.2, Firefox ESR below 91.6.1, Firefox for Android below 97.3.0, Firefox Focus below 97.3.0, and Thunderbird below 91.6.2 are affected. The bug was exploited as a zero-day in the wild before patches shipped, is listed in CISA's KEV (added 2022-03-07), and contemporaneous reporting tied the exploitation to a commercial spyware vendor (Variston) alongside companion flaw CVE-2022-26486. Do: Upgrade immediately to Firefox 97.0.2 or later, Firefox ESR 91.6.1 or later, Firefox for Android 97.3.0 or later, Firefox Focus 97.3.0 or later, and Thunderbird 91.6.2 or later, per the CISA KEV required action; there is no reliable workaround short of patching. Because the flaw was actively exploited as a zero-day and linked to targeted spyware delivery, treat endpoints that loaded untrusted web content on vulnerable versions as potentially compromised and review browser/mail host logs and EDR telemetry for follow-on activity. | 8.8 | 14% | KEV PoC |
| mass≈100M+ users (Firefox alone has hundreds of millions of active users, plus large Firefox ESR enterprise fleets and tens of millions of Thunderbird installs) |
Full article559 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 01, 2022Threat Detection / Zero Day
A Barcelona-based surveillanceware vendor named Variston IT is said to have surreptitiously planted spyware on targeted devices by exploiting several zero-day flaws in Google Chrome, Mozilla Firefox, and Windows, some of which date back to December 2018.
"Their Heliconia framework exploits n-day vulnerabilities in Chrome, Firefox, and Microsoft Defender, and provides all the tools necessary to deploy a payload to a target device," Google Threat Analysis Group (TAG) researchers Clement Lecigne and Benoit Sevens said in a write-up.
Variston, which has a bare-bones website, claims to "offer tailor made Information Security Solutions to our customers," "design custom security patches for any kind of proprietary system," and support the "the discovery of digital information by [law enforcement agencies]," among other services.
The vulnerabilities, which have been patched by Google, Microsoft, and Mozilla in 2021 and early 2022, are believed to have been utilized as zero-days to help customers install malware of their choice on the targeted systems.
Heliconia comprises a trio of components, namely Noise, Soft, and Files, each of which are responsible for deploying exploits against bugs in Chrome, Windows, and Firefox, respectively.
Noise is designed to take advantage of a security flaw in the Chrome V8 JavaScript engine that was patched in August 2021 as well as an unknown sandbox escape method called "chrome-sbx-gen" to enable the final payload (aka "agent") to be installed on targeted devices.
However, the attack banks on the prerequisite that the victim accesses a booby-trapped webpage to trigger the first-stage exploit.
Heliconia Noise can be additionally configured by the purchaser using a JSON file to set different parameters like the maximum number of times to serve the exploits, an expiration date for the servers, redirect URLs for non-target visitors, and rules specifying when a visitor should be considered a valid target.
Soft is a web framework that's engineered to deliver a decoy PDF document featuring an exploit for CVE-2021-42298, a remote code execution flaw impacting Microsoft Defender that was fixed by Redmond in November 2021. The infection chain, in this case, entails the user visiting a malicious URL, which then serves the weaponized PDF file.
The Files package – the third framework – contains a Firefox exploit chain for Windows and Linux that leverages a use-after-free flaw in the browser that was reported in March 2022 (CVE-2022-26485). However, it's suspected that the bug was likely abused since at least 2019.
Google TAG said it became aware of the Heliconia attack framework after receiving an anonymous submission to its Chrome bug reporting program. It further noted that there's no current evidence of exploitation, either indicating the toolset has been put to rest or evolved further.
The development arrives more than five months after the tech giant's cybersecurity division devoted to tracking government-backed hacking and attacks linked a previously unattributed Android mobile spyware, dubbed Hermit, to Italian software outfit, RCS Lab.
"The growth of the spyware industry puts users at risk and makes the Internet less safe, and while surveillance technology may be legal under national or international laws, they are often used in harmful ways to conduct digital espionage against a range of groups," the researchers said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/12/google-accuses-spanish-spyware-vendor.html