CVE-2011-0609

Researchers at Symantec say a sophisticated backdoor Trojan known as Egobot is targeting confidential information from South Korean companies as well as corporation doing business with South Korea.

When we discuss exploit prevention, we often talk about “targeted applications.’ This term refers to end-user applications which can be exploited by hackers for malicious purposes. There are a few requirements that define these applications. They receive external content: In order to deliver the exploit, the attacker must be able to provide the user with specially crafted content that contains the malicious exploit (a.k.a. weaponized content). This can be for example an HTML web page … More →

“IXESHE” Attack Campaign Leveraged “Weaponized” PDFs Targeting Zero-day Exploits Dating Back to 2009. Trend Micro has revealed details on a series of attacks that tried to stay under the radar by using machines inside compromised networks as command and control (C&Cs) servers.

RSA has started providing more detail into the mid-March attack on its SecurID token-based authentication system, but to get a fuller story you have to be an RSA customer willing to sign a nondisclosure agreement (NDA). An NDA means that you agree to keep secret what RSA would be willing to tell you. Sources say […]

More than two weeks have passed since the high profile RSA hack, and the company has finally decided to share some of the details regarding the attack. The question that is uppermost on most people’s minds – What information did the attacker manage to get their hands on? – still remains unanswered, but at least we now know how he managed to breach the company defenses. It all started with a malicious email, to which … More →

Japan’s seemingly unending series of misfortunes has so far generated a vast variety of online scams. The latest one includes spam emails containing Excel attachments rigged with Flash exploits. The subject line states: “Japan Nuclear Radiation Leakage and Vulnerability Analysis”, and the email is supposedly sent by the Office of Nuclear Security and Incident Response with the U.S. Nuclear Regulatory Commission. Given that lots of people are worried about the effects that the Fukushima reactor … More →

Adobe has issued a warning of a newly identified critical vulnerability in its Flash Player, and that the vulnerability is being exploited in targeted attacks via a Flash (.swf) file embedded in Microsoft Excel (.xls) files delivered via email.

A critical vulnerability exists in Adobe Flash Player 10.2.152.33 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems (Adobe Flash Player 10.2.154.18 and earlier for Chrome users), Adobe Flash Player 10.1.106.16 and earlier versions for Android, and the authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems. This vulnerability (CVE-2011-0609) could cause a crash and potentially allow an attacker … More →