Adobe confirms zero-day exploit bypasses Adobe Reader sandbox
The attacks are highly sophisticated and likely part of an important cyberespionage operation, a Kaspersky Lab researcher says
IDG News Service - A recently found exploit that bypasses the sandbox anti-exploitation protection in Adobe Reader 10 and 11 is highly sophisticated and is probably part of an important cyberespionage operation, the head of the malware analysis team at antivirus vendor Kaspersky Lab said.
The exploit was discovered Tuesday by researchers from security firm FireEye, who said that it was being used in active attacks. Adobe confirmed that the exploit works against the latest versions of Adobe Reader and Acrobat, including 10 and 11, which have a sandbox protection mechanism.
"Adobe is aware of reports that these vulnerabilities are being exploited in the wild in targeted attacks designed to trick Windows users into clicking on a malicious PDF file delivered in an email message," the company said in a security advisory published Wednesday.
Adobe is working on a patch, but in the meantime users of Adobe Reader 11 are advised to enable the Protected View mode by choosing the "Files from potentially unsafe locations" option under the Edit > Preferences > Security (Enhanced) menu.
The exploit and the malware it installs are super high-level, according to Costin Raiu, director of Kaspersky Lab's malware research and analysis team. "It's not something you see every day," he said Thursday.
Judging by the sophistication of the attacks, Raiu concluded that they must be part of an operation of "huge importance" that "would be on the same level with Duqu."
Duqu is a piece of cyberespionage malware discovered in October 2011 that's related to Stuxnet, the highly sophisticated computer worm credited with damaging uranium enrichment centrifuges at Iran's nuclear plant in Natanz. Both Duqu and Stuxnet are believed to have been created by a nation state.
The latest exploit comes in the form of a PDF document and attacks two separate vulnerabilities in Adobe Reader. One is used to gain arbitrary code execution privileges and one is used to escape from the Adobe Reader 10 and 11 sandbox, Raiu said.
The exploit works on Windows 7, including the 64-bit version of the operating system, and it bypasses the Windows ASLR (address space layout randomization) and DEP (Data Execution Prevention) anti-exploitation mechanisms.
When executed, the exploit opens a decoy PDF document that contains a travel visa application form, Raiu said. The name of this document is "Visaform Turkey.pdf."
The exploit also drops and executes a malware downloader component that connects to a remote server and downloads two additional components. These two components steal passwords and information about the system configuration, and can log keystrokes, he said.
The communication between the malware and the command-and-control server is compressed with zlib and then encrypted with AES (Advanced Encryption Standard) using RSA public-key cryptography.
- Study: Total Economic Impact of Google Apps Employees can work faster and IT spending can decrease when companies switch to Google Apps, says a commissioned study by Forrester Consulting. Going...
- Best Practices in BYOD - Addressing BYOD Challenges in the Enterprise Take control of the iOS, Android™ and BlackBerry® devices in your organization, from one powerful, unified console.
- Built for Business: 10 Reasons BlackBerry Smartphones Are Still the Best Way to Do Business The BlackBerry® 10 mobile computing platform removes many of the barriers that slow down other devices. Here are just a few of the...
- Choosing an MDM Platform: Where to Start the Conversation If you're in the early stages of choosing an MDM solution, or you're considering switching vendors, here are seven critical questions to ask...
- Increasing the Value of Your Reports and Dashboards Learn how incorporating other analytical capabilities such as predictive modeling and visualization can increase the value of your reports and dashboards by providing...
- Video surveillance for IT: maximum image quality, minimum bandwidth Join us on Thursday, May 8th at 1 p.m. EST when Willem Ryan, Senior Product Marketing Manager at Avigilon, will discuss how IT... All Management White Papers | Webcasts