CVE-2015-0313

It’s a new year and while some things change, some things stay the same (or similar). There’s lots of FUD about the sophisticated cyber attacks that are multi-threaded and obfuscated. Certainly there are attacks that fall into this category, but if you look at all of the cybercrime activity from the past year, it’s clear that the majority of threats do not have the level of sophistication that is often talked about.

As if you need more reasons to hate Adobe Flash, it’s unsurprisingly a favorite among cyber criminals to roll into exploit kits. The most popular exploit kit right now is Angler, which has been around since 2013, but it is still “regularly tied to malware including Cryptolocker.” According to a new report by Recorded Future, […]

Just days after the developers of the Angler exploit kit started leveraging a recently patched Flash Player vulnerability to distribute malware, an exploit for the same security bug was also added to the Magnitude, Neutrino and Nuclear Pack exploit kits.

What follows is a detailed analysis of the root cause of a vulnerability we call CVE-2015-X, as well as a step-by-step explanation of how to trigger it. For more on Flash vulnerabilities, we also invite you to read "The Latest UAF Vulnerabilities in Exploit Kits," published May 28 by Tao Yan. Not too long ago we

Introduction Recently, several popular exploit kits, including Angler, Flash EK, SweetOrange, Fiesta andNeutrino[1], have included several use-after-free (UAF) vulnerabilities in Adobe Flash to exploit victims’ browsers. Previously, these exploit kits typically used out-of-bounds access (OBA) vulnerabilities in Adobe Flash, as these types of vulnerabilities can be exploited universally and stably [2], and require less effort

OverviewDiscovering a new vulnerability in a popular piece of software is the Holy Grail for cybercriminals. The period between this vulnerability…

Over a hundred forum websites have been compromised and injected with code that redirects users to sites hosting the Fiesta exploit kit, Cyphort researchers have found. These are not highly popular forums, but gather a respectable number of users who like to discuss DIY projects, animals, wrestling, scuba diving, news regarding PS3, and so on. They are powered by either vBulletin or by IP Board online forum software, new vulnerabilities for which are often found … More →

Update: The ad network, Engage:BDR terminated the malvertising account quickly after notification, on Monday at 10:32AM. We can confirm that this…

DISCLAIMER: THIS POST INCLUDES SOME LANGUAGE AND TOPICS THAT MIGHT NOT BE SUITABLE FOR ALL READERS, PLEASE BE ADVISED AND PROCEED…

Here’s an overview of some of last week’s most interesting news and articles: Overcoming the daily challenges of a security team The institutionalization of domestic security and incident-response into a distinct profession have formed three major challenges for large enterprises. Security outlook: Technologies and key trends Anonymous threats and lone wolf attacks, increasing fears on cyber security and concerns over immigration will generate significant debate over foreign policy and how to mitigate the security risk … More →

Adobe has released Flash Player security updates that address a total of 18 vulnerabilities, most of which could be exploited for arbitrary code execution.

Invincea has been monitoring the Fessleak campaign in which hackers leveraged Adobe Flash Player exploits and file-less infections to serve ransomware. Security experts from Invincea are investigating on a new Ransomware campaign originated in Russia that presented many interesting characteristics. The researchers discovered that the attacks started by using file-less infections then moved to the […]

Researchers at Invincea have been monitoring a malvertising campaign in which malicious actors leveraged Adobe Flash Player exploits and file-less infections to deliver ransomware. The campaign, dubbed “ Fessleak ” based on the email address used to register the domains involved in the attack, appears to be the work of Russian cybercriminals.

Adobe has released Flash Player 16.0.0.305, a new version that fixes the latest zero-day flaw (CVE-2015-0313) that is currently exploited in mass malvertising campaigns. An exploit for the flaw has been recently added to the Hanjuan exploit kit, and malicious ads shown on a number of high-profile sites redirect users to sites hosting it. While the existence of the flaw was made public only this week, cyber crooks exploited it as far back as December … More →

Adobe Systems has made a patch available for a zero-day vulnerability in Flash Player that came under attack in recent days.

Attackers who have slipped malicious advertisements onto major websites over the last month have potentially compromised large numbers of computers. Several security vendors have documented attacks involving malicious advertisements, which automatically redirect victims to other websites or pages that silently attack their computer and install malware. “We certainly see malvertising on the rise,” said Nick […]

It has been a tough beginning of the year for Adobe and a dangerous one for Adobe Flash Player users. The recently discovered zero-day vulnerability (CVE-2015-0313) affecting the last existing version of the software is being actively exploited in the wild via the Hanjuan exploit kit. According to Malwarebytes researchers, this flaw has been exploited as far back as December 9, 2014, and users are targeted via malicious ads shown on a number of high-profile … More →

A third critical zero-day vulnerability affects Adobe Flash Player 16.0.0.296 and earlier versions for Windows, Linux and Mac. It is the third time in a few weeks that the security of Adobe users is menaced by a zero-day in Flash that affects Windows, Linux and OS X systems. The company is already working to provide a patch […]

Adobe Systems plans to release a patch this week for a zero-day vulnerability caught being exploited in malvertising attacks.

A new Adobe Flash zero-day, the third one this year so far, has been found in the wild via drive-by download…

A new Adobe Flash Player zero-day flaw is being actively exploited in the wild via the Angler exploit kit, Trend Micro threat analyst Peter Pi has warned. The flaw (CVE-2015-0313) affects Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh, and is currently being aimes at running Internet Explorer and Firefox on Windows 8.1 and below. The active attacks have been first spotted by Trend Micro researchers. “According to our data, visitors of … More →