Report: Adobe zero

Adobe has issued an out-of-bound patch for the bug, which allows for an attacker to execute malicious code on a victims' system.

Adobe issued a new patch for a zero-day security vulnerability that exploited a flaw in the company’s Flash Player. The flaw, uncovered by researchers from the security vendor Gigamon, was exploitable through Microsoft Word, according to a report published Wednesday.

Researchers discovered the vulnerability after a Ukrainian IP address submitted the details to VirusTotal, a malware analysis site, the Gigamon report said. The document was made to look like a job application form for a Russian health clinic, but in fact was meant to deliver reconnaissance malware. Researchers also said the hacking technique was similar to tools used by HackingTeam, an Italian surveillance company that had much of its spyware leaked in 2015.

Gigamon researchers did not attribute this malware to HackingTeam because many of the company’s tools have been publicly accessible online for three years, meaning other hackers could have replicated some of that malicious code. The researchers also did not prioritize attribution, arguing that it’s more important to protect against the attack.

“At best, [attribution] could aid the victim’s organization in determining intent and guiding response actions, but in reality, whether it is Hacking Team, a impersonator, or completely unrelated, the fact remains a valid zero-day might have been used to perform targeted exploitation against a victim,” the researchers wrote.

Researchers say the malicious Word document contains an embedded Flash ActiveX control — a way to use Flash Player within Microsoft Office program — which detects when the document is opened, then exploits Flash within Microsoft Word. The technique highlights how Adobe’s Flash player, despite years of warnings from security researchers, still is a popular method of attack for hackers.

“Although the death of Flash has been widely reported thanks to industry efforts to deprecate and remove Flash from web browsers, vectors such as Microsoft Office remain able to load and execute Flash content,” the report says. “Flash exploitation can be expected to continue as long as there are valid weaponization vectors that permit reliable execution.”

Researchers said with moderate confidence that the payload associated with the attack is a variant of the Scout malware, which is linked to HackingTeam. Scout collects system information form its target and sends it back to the perpetrator’s sever.

The phishing files and payloads have attributes that might make them look benign to defensive programs on the victim’s computer, like metadata and certificates associated with legitimate organizations.

Gigamon researchers note that they did not observe the attack affecting any victims. However the specific premise of the lure Word document makes this look like a highly targeted attack, researchers said. They cautioned that they have observed “other spear phishing attacks with lures with no relation to their actual targets and thus without visibility over the affected persons.”

The research was done by Gigamon’s Applied Threat Research (ATR) team, which was recently integrated into the company when Gigamon acquired network security startup ICEBRG.

The disclosure to Adobe prompted the company to release an out-of-band patch on Wednesday, two weeks after another unscheduled patch for a zero-day flaw (CVE-2018-15982). Flash is considered one of the most risk-prone popular programs and Adobe has said it will stop supporting it in 2020.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

• FBI raises alarm over deceptive phishing campaign targeting prominent people

• McKesson copes with fallout from data theft extortion attack

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure