CVE-2012-1889

The 5th installment in a series of posts tracking web-based threats over time from our Email Link Analysis (ELINK) system., specifically, statistics pertaining to malicious URLs, domains, exploit kits, vulnerabilities, and phishing scams.

Our Email Link Analysis (ELINK) system is routinely reviewed by our Unit 42 research team. In examining the data it collects, patterns and trends are discovered which helps us discern prevalent web threats. This blog is the third (3rd quarter of 2018) in a series of posts tracking web-based threats throughout the year, specifically statistics pertaining to malicious URLs, domains, exploit kits, and CVEs.

Japanese commercial and critical infrastructure organizations have been targeted a long-running campaign dubbed Operation Dust Storm. Security firm Cylance have uncovered a long-running hacking campaign dubbed ‘Operation Dust Storm’ targeting commercial and critical infrastructure organizations in Japan. Threat actors behind the Operation Dust Storm have been active since at least 2010, the hackers targeted several organizations in Japan, […]

Commercial and critical infrastructure organizations in Japan have been targeted in a multi-year campaign dubbed by researchers “Operation Dust Storm.”

Researchers at Symantec say the Elderwood attack platform is at the center of numerous zero-day attacks launched by hacker crews around the world this year.

The simplicity of the malware that paralyzed the computer networks of three banks and two broadcasters in technically sophisticated South Korea is a warning that U.S. corporations need to rethink security. The cybercriminals did nothing out of the ordinary in penetrating the organizations’ defenses on Wednesday. They used existing malware called “DarkSeoul,” changed its signature […]

Researchers at AlienVault shed some light on the evolution of the Sykipot malware attacks. The Sykipot attacks have exploited a number of zero-days during the past few years, including vulnerabilities affecting Adobe Reader, Adobe Flash Player and Microsoft Internet Explorer.

U.S companies and government agencies can learn from the large-scale disruptions that have simultaneously hit several banks and media outlets in South Korea in the last 24 hours. Early analyses by security firms suggest that the attacks were carried out using previously known vulnerabilities and exploits. So while considerable attention is being paid to whether […]

Where 2012 was a period of great innovation amongst cybercriminals and hackers – many of whom keenly develop new and hybridized attack vectors that build on a constantly expanding range of extensible code environments seen running on Windows and Apple Mac platforms – 2013 is likely to go down in the darkware IT history books as a period of consolidation. This trend will be driven, we predict, by the not inconsiderable fact that the incredible … More →

Researchers at Symantec say the waterholing attacks utilizing the recently-publicized Internet Explorer zero-day are tied to a gang responsible for a spate of similar kinds of attacks.

The latest Java vulnerability has been integrated into both Black Hole and Gong Da exploit kits, making it easier for cyber-criminals to launch attacks exploiting the flaw, a security researcher said.

An elite hacker group targeting defense industry sub-contractors has an inexhaustible supply of zero-days, or vulnerabilities that have yet to be publicized, much less patched, Symantec said today. In a blog post, the security firm said, “The group seemingly has an unlimited supply of zero-day vulnerabilities.” Symantec also laid out its analysis of the gang, […]

Here’s an overview of some of last week’s most interesting news, videos, interviews and articles: Worldwide IT spending to surpass $3.6 trillion in 2012 In contrast to the rather lackluster growth outlook for overall IT spending, Gartner expects enterprise spending on public cloud services to grow from $91 billion worldwide in 2011 to $109 billion in 2012. By 2016, enterprise public cloud services spending will reach $207 billion. Fake anti-piracy warnings hitting UK users with … More →

The long awaited patch for the CVE-2012-1889 vulnerability that has been heavily exploited in the wild and the exploit for which has even been included in the Blackhole Exploit Kit is not the only big news from the latest Patch Tuesday. Among other things, Microsoft has notified users that it has made available an automated Microsoft Fix it solution (a workaround – not a patch) that disables the Windows Sidebar and Gadgets on supported editions … More →

Every Patch Tuesday, my inbox fills up with commentary from patch management experts on Microsoft’s latest fixes. Rather than toss them aside, I like to run their analysis as is. With that, here’s the July 2012 breakdown, in which Microsoft released nine bulletins addressing 16 vulnerabilities: Jason Miller, Manager of Research and Development, VMware The […]

The Microsoft Security Bulletin Summary for July 2012 contains nine security bulletins addressing 16 CVEs. Three of the bulletins are rated critical and the other six are rated important. All of the critical bulletins address vulnerabilities where a victim could be exploited if they visit malicious web pages, and should serve as a warning that organizations will continue to face client-side browser related attacks. MS12-043 addresses a vulnerability that is currently being exploited in the … More →

Patch Tuesday is tomorrow. Expect nine security bulletins, three of them for critical vulnerabilities in Windows and Internet Explorer. If Microsoft sticks to plan, the rest will cover “important” security holes in Office, developer tools and server software. Here’s some analysis from three patch management experts: Wolfgang Kandek, CTO of Qualys: Bulletin 1, rated “critical,” […]

The Microsoft Security Bulletin Advance Notification for July 2012 contains nine bulletins, with three listed as “critical” and six listed as “important.” Many are expecting a patch for CVE-2012-1889: a vulnerability in Microsoft XML Core Services, which is currently being exploited in the wild. Microsoft released a temporary fix for this last month, and hopefully organizations will apply that while Microsoft works on a permanent fix; however, it isn’t clear whether that will be issued … More →

Researchers at AlienVault believe an updated version of the Sykipot Trojan is being used to target the aerospace industry.

An exploit for an unpatched vulnerability in the Microsoft XML Core Services (MSXML) has been incorporated into Blackhole, one of the most widely used Web attack toolkits, according to security researchers from antivirus firm Sophos. The security flaw is identified as CVE-2012-1889 and is what security researchers call a zero-day vulnerability — an actively exploited […]

Here’s an overview of some of last week’s most interesting news, podcasts, interviews and articles: Real life examples on hackers bypassing CAPTCHA Computer-assisted tools and crowd sourcing can easily bypass traditional anti-spam solutions, forcing CAPTCHAs to evolve to address these techniques, according to Imperva. Vulnerabilities in open source WAF ModSecurity During our research of web application firewall evasion issues, we uncovered a flaw in ModSecurity that may lead to complete bypass of the installed rules, … More →

An unpatched Windows vulnerability considered a critical threat by security experts is being exploited by cybercriminals. Microsoft disclosed the flaw in XML Core Services (MSXML) 3.0, 4.0 and 6.0 June 12 during its monthly release of patches. The security advisory, which was separate from the patch release, offered a workaround for vulnerability CVE-2012-1889, but no […]

The still unpatched Microsoft XML Core Services vulnerability (CVE-2012-1889) that allows attackers to gain the same user rights as the logged on user and execute malicious code remotely is being actively exploited in the wild. According to Sophos, the website of a European aeronautical parts supplier has been recently compromised and found serving a file infected with the code that tries to exploit the aforementioned zero-day. Given that the vulnerability was recently tied to Google’s … More →

Attack code for two actively exploited vulnerabilities in Microsoft software, one of which has not yet been patched, was integrated into the open-source Metasploit penetration testing framework. One of the vulnerabilities is identified as CVE-2012-1875 and is located in Internet Explorer. Attackers can exploit it to execute malicious code by tricking users into visiting a […]