Hacking Millions with Just an Image — Recipe: Pixels, Ads & Exploit Kit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-8651 | Integer Overflow in Adobe Flash Player Enables Remote Code Execution CVE-2015-8651 is an integer overflow (CWE-189, a numeric error-handling flaw) in Adobe Flash Player that allows attackers to execute arbitrary code when Flash processes specially crafted content. The realistic trigger is a drive-by web attack: a user browses to a compromised or attacker-controlled page, often reached through malvertising or exploit kits, and the malicious Flash (SWF) content exploits the overflow in the user's browser or standalone player. Successful exploitation gives the attacker code execution in the context of the logged-in user, typically as a delivery mechanism for ransomware, information stealers, or miners, as seen in exploit-kit campaigns of the era (RIG, Neptune, Stegano, and others were distributing Flash exploits at the time). Anyone running an affected version of Adobe Flash Player was exposed; Flash was near-universally deployed in 2015-2016, though the product has since reached end of life (December 31, 2020) and modern browsers no longer load it. Exploitation is confirmed in the wild: CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2022-05-25, EPSS assigns it a 67.9% probability of exploitation in the next 30 days (99th percentile), and no public PoC is cataloged. Do: Uninstall or disable Adobe Flash Player on all remaining systems, since it is end-of-life and CISA's required action is to disconnect/remove it if still in use. If legacy Flash cannot be removed immediately, apply Adobe's January 2016 security update (APSB16-01) and restrict those hosts from untrusted web browsing and ad content. Inventory for standalone Flash players, intranet applications that embed SWF content, and copies of Flash bundled inside other applications. | — | 68% | KEV |
| mass~1 billion+ installations historically (near-universal desktop Flash deployment in 2015-2016); residual exposure today limited to unmigrated legacy systems,… | |
| CVE-2016-0162 | Information Disclosure via JavaScript File Detection in Microsoft Internet Explorer CVE-2016-0162 is an information disclosure flaw (CWE-200) in Microsoft Internet Explorer caused by improper handling of JavaScript, which can allow an attacker to detect the presence of specific files on a user's computer. It is triggered when Internet Explorer processes attacker-controlled JavaScript, typically when a user views a crafted webpage or embedded web content. What the attacker gains is reconnaissance value rather than code execution: confirmation that named files exist on the victim's machine, which can be used to tailor more targeted follow-on attacks. Any user running the affected Internet Explorer versions is potentially exposed, although the source data does not enumerate specific version ranges beyond 'Microsoft Internet Explorer.' The flaw was added to CISA's Known Exploited Vulnerability (KEV) catalog on 2022-05-24, confirming exploitation in the wild; EPSS estimates a 22.1% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known. Do: Apply Microsoft security updates for Internet Explorer per vendor instructions, prioritizing user workstations and any internet-facing systems where IE is in use, and treat this as a patch-now item given the KEV listing. Verify that IE builds are current against Microsoft's cumulative IE security updates, since the source data does not list specific fixed versions. Where feasible, reduce attack surface by steering users to supported modern browsers or restricting legacy IE to trusted sites; CISA lists ransomware association as unknown, so confirm whether your threat intel ties this CVE to known campaigns. | 4.3 | 22% | KEV |
| masshundreds of millions of users (IE historically shipped by default on Windows; exact counts of unpatched installs unknown) | |
| CVE-2016-1019 | Arbitrary code execution flaw in Adobe Flash Player, used in ransomware attacks CVE-2016-1019 is a remotely exploitable flaw in Adobe Flash Player that lets an attacker cause a denial of service or, in the worst case, execute arbitrary code on the victim's system. It is triggered remotely, typically when a user views malicious Flash content delivered through a web browser, an application, or a document that embeds Flash content. A successful attack runs code with the privileges of the logged-on user, making the bug a useful foothold for deploying malware, including ransomware. Anyone still running Adobe Flash Player is potentially affected - the product is end-of-life (support ended December 31, 2020), but it persists on legacy desktops, intranet applications, kiosks, and embedded or industrial systems; the CISA data does not list specific affected version ranges. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, notes known ransomware use, and EPSS assigns a 22.5% probability of exploitation in the next 30 days (98th percentile), though no public proof-of-concept is catalogued. Do: Per CISA's required action, disconnect or remove any system still running Adobe Flash Player, since the product is end-of-life and receives no further security updates; the bug was patched in Adobe's 2016 updates, so only long-unupdated or embedded Flash installs remain vulnerable. Uninstall Flash from browsers and legacy software and confirm that no internal applications or sites still serve or require SWF content. Because exploitation is tied to ransomware campaigns, prioritize user workstations and any internet-facing host with Flash installed. | 9.8 | 22% | KEV ransomware |
| mass≈ millions of legacy endpoints worldwide (Flash historically ran on ~99% of internet-connected PCs; current residual install count unknown) | |
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier CVE-2016-4117 is a critical (CVSS 3.1: 9.8) arbitrary code execution vulnerability in Adobe Flash Player 21.0.0.226 and earlier, in which unspecified vectors in the Flash runtime allow remote attackers to execute arbitrary code. It is triggered by delivering malicious Flash content over a network — for example a crafted SWF loaded by a browser or an application that embeds Flash — and, per its CVSS scoring, requires no privileges or authentication. A successful exploit gives the attacker code execution in the context of the Flash runtime (typically the user's browser process), which public reporting shows was used to deliver espionage tooling and, per CISA, is also known to be used in ransomware campaigns. Anyone running Flash Player 21.0.0.226 or earlier was affected, including users of the flash-player packages shipped for Red Hat Enterprise Linux Desktop, Server (including the RHUI variant) and Workstation, openSUSE, openSUSE Evergreen, and SUSE Linux Enterprise Desktop and the SUSE Linux Enterprise Workstation Extension. The bug was exploited in the wild in May 2016 — related headlines tie it to the BlackOasis APT 'Operation Daybreak' espionage campaign using FinFisher — and it was added to the CISA KEV on 2022-03-03 with known ransomware use and a very high 94.4% EPSS. Do: Per CISA's required action, Flash Player is end-of-life: remove or disable Flash wherever it is still present and uninstall the flash-player packages on any remaining RHEL, SUSE or openSUSE hosts, especially internet-facing systems. If a legacy system must keep Flash, ensure it runs a release later than 21.0.0.226 (a fixed build from the May 2016 Adobe update or later) and restrict it from untrusted web content. | 9.8 | 94% | KEV ransomware PoC |
| mass≈100M+ desktop users at the time of disclosure (Flash was then near-universal); residual small base of end-of-life installs today |
Full article574 words · extracted from thehackernews.com · click to collapse
The Hacker NewsDec 07, 2016
If you have visited any popular mainstream website over the past two months, your computer may have been infected — Thanks to a new exploit kit discovered by security researchers.
Researchers from antivirus provider ESET released a report on Tuesday stating that they have discovered an exploit kit, dubbed Stegano, hiding malicious code in the pixels of banner advertisements that are currently in rotation on several high profile news websites.
Stegano originally dates back to 2014, but since early October this year, cyber crooks had managed to get the malicious ads displayed on a variety of unnamed reputable news websites, each with Millions of daily visitors.
Stegano derived from the word Steganography, which is a technique of hiding messages and content inside a digital graphic image, making the content impossible to spot with the naked eye.
In this particular malvertising campaign, operators hide malicious code inside transparent PNG image's Alpha Channel, which defines the transparency of each pixel, by altering the transparency value of several pixels.
The malvertising campaign operators then packed the altered image as an advertisement and managed to display those malicious ads on several high-profile websites.
According to the researchers, the malicious ads promote applications called "Browser Defense" and "Broxu," and the methodology makes it tough for ad networks to detect.
Here's How the Stegano Attack Works:
Once a user visits a site hosting malicious advertisement, the malicious script embedded in the ad reports information about the victim's computer to the attacker's remote server without any user interaction.
The malicious code then uses the CVE-2016-0162 vulnerability in Microsoft's Internet Explorer (IE) browser in order to scan the target computer to see if it is running on a malware analyst's machine.
After verifying the targeted browser, the malicious script redirects the browser to a website that hosts Flash Player exploits for three now-patched Adobe Flash vulnerabilities: CVE-2015-8651, CVE-2016-1019, and CVE-2016-4117.
"Upon successful exploitation, the executed shell code collects information on installed security products and performs – as paranoid as the cybercriminals behind this attack – yet another check to verify that it is not being monitored," ESET researchers wrote in a blog post. "If results are favorable, it will attempt to download the encrypted payload from the same server again, disguised as a gif image."
When downloaded to the victim's computer, the encrypted payload is then decrypted and launched via regsvr32.exe or rundll32.exe in Microsoft Windows.
Just Visit a Site, and You'll be Hacked in Just 2-3 Sec
Below is an ESET infographic that explains the working of Stegano's exploit attack:
All the above operations execute automatically without any user interactions and takes place in the span of just 2-3 seconds.
So far, the Stegano exploit kit has pushed various trojan downloaders, the Ursnif and Ramnit banking trojans, backdoors, spyware, and file stealers.
The Stegano exploit kit was initially used in 2014 to target people in the Netherlands, and then in 2015, moved on to residents in the Czech Republic. The latest attack campaign is targeting people in Canada, the UK, Australia, Spain, and Italy.
The best way to protect yourself against any malvertising campaign is always to make sure you are running updated software and apps. Also use reputed antivirus software that can detect such threats before they infect your system.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2016/12/image-exploit-hacking.html