Exploit for Flash vuln targets users in Japan for financial info
- http://www.symantec.com/connect/blogs/recent-exploit-adobe-flash-vulnerability-targeting-users-japan-financial-information
Updated: 30 May 2014 - "… research now indicates that the attacks are being performed on a massive scale and that majority of them are focused on Japan. Back in April, CVE-2014-0515 was originally being exploited in watering-hole attacks against specific organizations or industries. Later in the same month, Adobe released a patch* for the vulnerability. However, just a few weeks later Symantec telemetry indicated that instead of the initial targets, the exploit was now being used to target a wider range of Internet users.
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/Figure1_12.png
… more than 90 percent of the attacks exploiting the vulnerability are targeting Japanese users. The attacks are typically carried out through drive-by-download and leverage compromised legitimate websites to host malicious code. The websites then redirect traffic to a malicious site prepared by the attacker… Once the browsers are redirected to the malicious site, which has the IP address 1.234.35.42**, they render the exploit code that attempts to exploit CVE-2014-0515. If an older version of the software is installed on the computer, the attack will execute a series of malicious files to compromise the computer… Cumulative number of attacks on Japanese users:
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/Figure3_6.png
Infostealer.Bankeiya.B monitors the Web browsers Google Chrome, Mozilla Firefox and Microsoft Internet Explorer. The Trojan gathers specific user data typically found in online banking transactions. The malware can also update itself, enabling it to target more banks and add more capabilities in order to perform additional malicious actions…"
* https://helpx.adobe.com/security/products/flash-player/apsb14-13.html
Flash 0-Day Exploit used by Angler Exploit Kit
- https://isc.sans.edu/diary.html?storyid=19213
2015-01-21 - "The "Angler" exploit kit is a tool frequently used in drive-by download attacks to probe the browser for different vulnerabilities, and then exploit them to install malware. The exploit kit is very flexible and new exploits are added to it constantly. However, the blog post below* shows how this exploit kit is currently using an unpatched Flash 0-day to install malware. Current versions of Windows (e.g. Window 8 + IE 10) appear to be vulnerable. Windows 8.1, or Google Chrome do not appear to be vulnerable… typically we see these exploits more in targeted attacks, not in widely used exploit kits. This flaw could affect a large number of users very quickly…"
* http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html
2015-01-21 - "… Angler EK exploiting last version (16.0.0.257) of Flash…"
Update: "… tested it against the free version of Malwarebytes Anti Exploit* (a product from one of my customers). That stopped it. Well done!…"
* https://www.malwarebytes.org/antiexploit/
- http://blog.trendmicro.com/trendlabs-security-intelligence/flash-greets-2015-with-new-zero-day/ Update as of January 22, 2015, 9:30 PM PST: "… Adobe released an update to Flash, bringing the latest version to 16.0.0.287. However, this does -not- patch the vulnerability described in this post. Instead, it fixes a -separate- vulnerability (CVE-2015-0310). A patch for the vulnerability described here (now designated as CVE-2015-0311) will be released sometime next week.*
In the mean time, we note that Chrome is still unaffected by this vulnerability. Users of other browsers who are unable to disable Flash Player (due to usability issues) can consider downloading ad blocking software or extensions, which would help in reducing the exposure to this threat."
> http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html
"… Any version of Internet Explorer or Firefox with any version of Windows will get owned if Flash up to 16.0.0.287 (included) is installed and enabled.
[Edit : 2015-01-22 - 15:30 GMT+2] Til this morning Firefox users were safe. Angler EK coders [hacks] 'fixed' the issue… and they are now under fire as well…"
*https://helpx.adobe.com/security/products/flash-player/apsa15-01.html
Updated: Jan 22, 2015 - "… We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8 and below. Adobe expects to have a patch available for CVE-2015-0311 during the week of January 26…"
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0311
Last revised: 01/23/2015
>> Recommend: DISABLE Flash extension/Plugin until that fix is available.
>> Firefox: >Tools >Addons >Plugins >Shockwave Flash 16.0.0.287 - Never Activate.
… until NEW UPDATED FIX from Adobe is released/installed.
___
Last revised: 02/04/2015 - "… as exploited in the wild in February 2015."
Platform: All Platforms
Summary: A critical vulnerability (CVE-2015-0313) exists in Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe expects to release an update for Flash Player during the week of February 2.
Affected software versions:
- Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh
- Adobe Flash Player 13.0.0.264 and earlier 13.x versions
Revisions: Removed Flash Player version 11.x from the list of affected versions. Version 11.x and earlier do not support the functionality affected by CVE-2015-0313.
- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/
Feb 2, 2015 - "… a new zero-day exploit in Adobe Flash used in -malvertisement- attacks. The exploit affects the most recent version of Adobe Flash, and is now identified as CVE-2015-0313… So far we’ve seen around 3,294 hits related to the exploit, and with an attack already seen in the wild, it’s likely there are other attacks leveraging this zero-day, posing a great risk of system compromise to unprotected systems. Since the exploit affects the latest version of Flash, 16.0.0.296, users may consider -disabling- Flash Player until a fixed version is released. Adobe has confirmed that this is a zero-day exploit and the patch is expected to be available this week to address this…"
___
Flash 0-Day used in Pawn Storm…
>> http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
Oct 13, 2015 - "… the attackers behind Pawn Storm[1] are using a new Adobe Flash zero-day exploit in their latest campaign. Pawn Storm is a long-running cyber-espionage campaign known for its high-profile targets and usage of thefirst Java zero-day* we’ve seen in the last couple of years… Based on our analysis, the Flash zero-day affects at least Adobe Flash Player versions 19.0.0.185 and 19.0.0.207… We have notified Adobe about our discovery and are working with them to address this security concern. Updates to this entry will be made once more information is available."
'Suggest Flash be -disabled- immediately until a new fix/release from Adobe is available…
>> https://helpx.adobe.com/security/products/flash-player/apsa15-05.html
Oct, 14, 2015 - "… A critical vulnerability (CVE-2015-7645) has been identified in Adobe Flash Player 19.0.0.207 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for this vulnerability is being used in limited, targeted attacks.
UPDATE: Adobe expects updates to be available as early as October 16."
Adobe Flash 0-day (CVE-2016-1019) in-the-Wild - Exploit Kits delivering Ransomware
- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2016-1019-zero-day-integrated-in-exploit-kit/
April 7, 2016 - "… Trend Micro has observed active zero day attacks from the Magnitude Exploit Kit affecting users of Flash 20.0.0.306 and earlier. These attacks are not effective against users of Flash versions 21.0.0.182 and 21.0.0.197. This is because of a heap mitigation that Adobe introduced in version 21.0.0.182 and is also present in version 21.0.0.197. Users of these versions will only experience a crash in Adobe Flash when attacks attempt to exploit the vulnerability. All users are highly recommended to immediately update their systems with the latest security fix* as this is actively being exploited in the wild. Prior to today’s security fix, we observed the exploit kit already integrating this vulnerability in its arsenal, which leaves systems infected with ransomware…"
* https://helpx.adobe.com/security/products/flash-player/apsb16-10.html
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1019
Last revised: 04/07/2016 10.0 HIGH
"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016."
