DaVinci surveillance malware distributed via zero-day Flash Player exploit, researchers say
The attacks targeted activists from the Middle East, according to Kaspersky Lab researchers
IDG News Service - Political activists from the Middle East were targeted in attacks that exploited a previously unknown Flash Player vulnerability to install a so-called lawful interception program designed for law enforcement use, security researchers from antivirus vendor Kaspersky Lab said Tuesday.
Last Thursday, Adobe released an emergency update for Flash Player in order to address two zero-day -- unpatched -- vulnerabilities that were already being used in active attacks. In its security advisory at the time, Adobe credited Sergey Golovanov and Alexander Polyakov of Kaspersky Lab for reporting one of the two vulnerabilities, namely the one identified as CVE-2013-0633.
On Tuesday, the Kaspersky Lab researchers revealed more information about how they originally discovered the vulnerability. "The exploits for CVE-2013-0633 have been observed while monitoring the so-called 'legal' surveillance malware created by the Italian company HackingTeam," Golovanov said in a blog post.
HackingTeam is based in Milan but also has a presence in Annapolis, Maryland, and Singapore. According to its website, the company develops a computer surveillance program called Remote Control System (RCS) that is sold to law enforcement and intelligence agencies.
"Here in HackingTeam we believe that fighting crime should be easy: we provide effective, easy-to-use offensive technology to the worldwide law enforcement and intelligence communities," the company says on its website.
Kaspersky Lab has been monitoring HackingTeam's RCS -- also known as DaVinci -- since August 2012, said Costin Raiu, director of Kaspersky Lab's global research and analysis team.
RCS/DaVinci can record text and audio conversations from different chat programs, including Skype, Yahoo Messenger, Google Talk and MSN Messenger; can steal Web browsing history; can turn on a computer's microphone and webcam; can steal credentials stored in browsers and other programs, and much more, he said.
Kaspersky researchers have detected around 50 incidents so far that involved DaVinci being used against computer users from various countries including Italy, Mexico, Kazakhstan, Saudi Arabia, Turkey, Argentina, Algeria, Mali, Iran, India and Ethiopia.
The most recent attacks that were exploiting the CVE-2013-0633 vulnerability targeted activists from a country in the Middle East, Raiu said. However, he declined to name the country in order to avoid exposing information that could lead to the victims being identified.
It's not clear if the zero-day exploit for CVE-2013-0633 was sold by HackingTeam together with the surveillance malware or if whoever purchased the program obtained the exploit from a different source, Raiu said.
HackingTeam did not immediately respond to a request for comment.
In previous attacks detected by Kaspersky Lab, DaVinci was distributed via exploits for Flash Player vulnerabilities that were discovered by French vulnerability research firm Vupen, Raiu said.
Vupen openly admits to selling zero-day exploits, but claims that its customers are government and law enforcement agencies from countries that are members or partners of the NATO, ANZUS or ASEAN geopolitical organizations.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
Red Hat Enterprise Linux - The Original Cloud Operating System
Linux adoption is growing against a number of measures, such as the
number of supercomputers that run Linux and the size of the contributing...
- OpenStack Hype vs. Reality: CIO Quick Pulse Open-source architecture can enable IT departments to build infrastructure-as-a-service (IaaS) clouds running on standard hardware.
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts