Zeus botnet exploits unpatched PDF flaw
Researchers spot first widespread attack using Reader, Acrobat design flaw
Computerworld - The Zeus botnet is now using an unpatched flaw in Adobe's PDF document format to infect users with malicious code, security researchers said today.
The attacks come less than a week after other experts predicted that hackers would soon exploit the "/Launch" design flaw in PDF documents to install malware on unsuspecting users' computers.
The just-spotted Zeus variant uses a malicious PDF file that embeds the attack code in the document, said Dan Hubbard, CTO of San Diego, Calif.-based security company Websense. When users open the rogue PDF, they're asked to save a PDF file called "Royal_Mail_Delivery_Notice.pdf." That file, however, is actually a Windows executable that when it runs, hijacks the PC.
Zeus is the first major botnet to exploit a PDF's /Launch feature, which is, strictly speaking, not a security vulnerability but actually a by-design function of Adobe's specification. Earlier this month, Belgium researcher Didier Stevens demonstrated how a multistage attack using /Launch could successfully exploit a fully-patched copy of Adobe Reader or Acrobat.
Stevens was not the first to reveal the /Launch vulnerability. In August 2009, a module using the same flaw was added to the open-source Metasploit penetration testing kit, said HD Moore, Metasploit's creator and the chief security officer at Rapid7. "Colin Ames of Attack Research wrote this module as part of his Black Hat USA presentation," said Moore. "Didier's work was independent of what we already had, but uses almost the same method at its core."
Today, Stevens said that the Zeus attack Trojan was actually using the Metasploit module. "From what I can read, the new Zeus PDF actually uses a [Metasploit] Adobe PDF exploit," Stevens said on Twitter, pointing to another description of the new attack by M86 Security of Orange, Calif.
Although Reader and Acrobat display a warning when an executable inside a PDF file is launched, that's not enough to stop users from launching the bogus document, said Websense's Hubbard. "No one is blanket-blocking PDFs at the gateway," he said. "There's so much business value in PDFs, and they're very pervasive." In other words, people trust PDFs, he said -- much more even than some other popular document formats, such as Microsoft Word.
Websense has tracked several thousand Zeus attacks using the embedded malware and /Launch function. "The attacks are still going on," Hubbard said.
While the attack technique may be new, the behind-the-scenes malware and the gang that produces it is standard Zeus fare, Hubbard continued. Zeus is best known for planting identity theft code on victims' PC to steal, for instance, online banking logon usernames and passwords. "The motives aren't any different here," said Hubbard.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts