Slashdot Mirror
Adobe Flash Zero-Day Attack Underway
Robellus writes "Security researchers have found evidence of a previously unknown Adobe Flash vulnerability being exploited in the wild. The zero-day flaw has been added to the Chinese version of the MPack exploit kit and there are signs that the exploits are being injected into third-party sites to redirect targets to malware-laden servers. From the article: 'Continued investigation reveals this issue is fairly widespread. Malicious code is being injected into other third-party domains (approximately 20,000 web pages) most likely through SQL-injection attacks. The code then redirects users to sites hosting malicious Flash files exploiting this issue.'"
And people wonder why I use noscript and flashblock. When untrusted adds in flash are being served on big "trusted" websites people are eventually going to get bit.
Situation Normal, All Flashed Up
This isn't the first or the last time Flash will have vulnerabilities discovered, and I understand this can happen with any software. It is just the frequency and consistency of these vulnerabilities that concerns me. When I install a binary blob from Adobe its always in the back of my mind that I could be opening up my system to attack.
Look out! Ben's brother has servers, and he plans to exploit them!
I always use noscrpt and flashblock extensions in firefox on Linux, so I'm not too concerned about this.
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
A taste of what it could've been and what it might yet become?
_
\\/ are accustomed' - First Lensman
What kind of horrible, horrible update scheme will Adobe come up with to try to combat this?! The thoughts are too terrible to imagine...
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
Once again Windows is open to attack from some 3rd party app... and what's this, SQL injection is being used... is that another MS product being abused or is it a free for all on open source DB driven websites?
Seems like there is plenty of blame to go around... Adobe included but certainly not alone. If Windows wasn't so easily subverted by a 3rd party app with a bug this wouldn't be an issue (as it's not for Mac and Linux users)... but of course were it not for lax security in countless websites, there would be no vector... so shame on web developers...
enjoy.
A fool throws a stone into a well and a thousand sages can not remove it.
Plain text is the only way to go! There's nothing more secure than plain text, except Silverlight!
.
.
.
.
.
Windows Live Mail: Want to get paid to post on forums? Visit www.microsoft.com today!
After all, it's my God-Given Right to name my son Robert'; DROP TABLE STUDENTS. I shouldn't be getting nasty phone calls from every school he's ever attended!
Request your free CD of my piano music.
In France, a popular IT proverb says "Adobe, c'est de la daube". True one more time today...
(won't translate; lost in translation).
-- Rastignac was here.
A Stack Canary is a value placed at the end of a function's stack frame. Just before function return, the canary's value is checked, and if it has changed, the user is notified.
So what you do is built a test version of Flash with canaries enabled in the compiler, then try feeding it all kinds of potentially buffer-overruning input.
To enable canaries:
- Visual Studio for Windows: Use the
/GS option
- GCC for Mac OS X: use -fstack-protector in your "Other C Flags" option in XCode
The Xcode-Users post I linked to says that stack canaries were discussed in session 109 at Apple's developer conference, in 2007 I think. You should be able to view it on the Apple Developer Connection website.I'll send you my bill in the mail.
Request your free CD of my piano music.
The french can't be funny.
It just doesn't happen.
Jerry Lewis is NOT funny !!
repeat: Jerry Lewis is NOT funny !!
I think the time has come to make a virus that counters spambots, trojans, viruses and everything else. Limited lifespan, get them into the wild, let them run through networks doing a good deed then martyr themselves. I know people would be worried about any possible damage done by these things, but if your system is open, then it's a risk vs potential damage assessment. If you have the right security in place, then neither goodie or baddie viruses will get near you.
That is not the definition of zero day. If you are going to condemn people for using it incorrectly, at least use it correctly yourself. The 'zero day' status merely refers to how long the exploit has been known - the 'zeroth' day being the day it is publicly disclosed. This day is important due to the fact it is basically impossible for people to be patched against the vulnerability on this day. In other words, tomorrow this will no longer be a 'zero day exploit'. (no doubt it was disclosed several days ago and isn't a zero day exploit today either).
I.O.U One Sig.
Well it didn't take long for me to notice that my modem often showed activity even when I wasn't doing anything online. At the advice of a friend I bought the ZoneAlarm firewall.
It informed me that I was infected with the Welchia worm. What it does is apply security fixes to your Windows installation, and then it propagates itself on to other Windows hosts over the Internet!
This drove home to me the importance, when using Windows, of having a firewall that prevents connection coming from my own computer. ZoneAlarm does this.
Most firewalls just prevent attacks from outside. But if you're already infected, you want to know about network traffic originating from your own computer.
Request your free CD of my piano music.
Right click on your next youtube video. See the privacy manager? Click through all the options and see that it's recorded EVERYTHING you've ever done and seen, including flash ads. And better than googlecookies.
The Adobe ad network is even more lucrative than Adsense.
> That's what temporary permissions are for.
Yes, I use them all the time, but what does that really mean? After I temporarily enable Flash/JS malware for a badly designed site which is just not viewable without them, I'm not going to get temporarily "pwned". It's already "game over".
Except for times like this, if the choice is enabling JS/Flash, or not getting information I was interested in, my thirst for information wins, all other things being equal (i.e., the URL looks like a legitimate one, etc.)
I never enable JS or Flash in order to see sites which I get to through advertisements, however.
He's absolutely right about the idea of separating the control from the data. No other well-designed architecture does things this way. Take TCP, for example, which requires you to open two TCP ports for every connection, one for control and one for data. Or Ethernet where you have to have two pairs of wires, one for control data and one for real data. Other examples where this is employed are RPC, UDP, and even the telephone system.
At first glance, it might seem like you'd need to introduce control characters into the data to differentiate the various parts of the data, in case you ever needed to put multiple fields with a single control statement (I know, it's rare, but some people _do_ need this). However, the TCP people invented an ingenious way of dealing with this by designating a special character for separating fields. All you need to do is escape it every time it occurs naturally in the stream. Then, all your problems are solved.
Well, you've still got the problem of associating the control data with the payload. They are, after all, on two different channels and could arrive at different times. That's a trivial problem, though, because you just send the control data first and wait a short time before sending the real data. Electronic signals always travel at the same speed.
Oh, we're not quite done yet. What happens if you want to embed user-entered data in the control? Well, that's easily handled, too, by moving everything except the framing sequences in the control channel into the data channel, so everything is data. I think that should work perfectly.
> XP/Vista/Slackware and Mandriva .... and the odds of none
> of the 4 seeing something odd are just as slim.
You're telling me that from each of those 4 OS's you run virus/malware scans on the other 3? I'm impressed at that setup. It's the dual situation to the following widely-posted-on-Slashdot xkcd comic.
When do you have time to do real work / play with them?
BTW, I wouldn't be so sure that your scanners are going to pick up everything. Anything which is specially targeted has a fairly good chance of slipping under the wire, the scanners mainly pick up "mass infection" tools and attacks. Of course, unless there is something special about your computers (like being in an especially interesting IP address block) you probably won't get specially targeted.
The 'zero day' status merely refers to how long the exploit has been known - the 'zeroth' day being the day it is publicly disclosed
If that's your definition, ('zero day' == <time of publication>) then it still hasn't been used correctly, since the linked article is already a day old.
Given that the phrase 'zero day' is made of two single syllable words, I can understand the propensity for its use. However, it conveys no information, except to indicate that the author is a buzz-word junkie. Why not call it a 'Same Day exploit ' or 'This Day exploit ', or even a 'Today exploit' ?? Because then people would realize that it's a vacuous phrase. Oddly, when there's a number involved, it sounds technical, and confusing, and causes alarm ! Do you think that's a coincidence ?
Furthermore, it is practically inconceivable that a vulnerability could have been discovered, incorporated into a 'Chinese version of the MPack exploit kit', whatever that is - as a side note: do you suppose they do a pre-release test on the new version of MPack kit? - , and reported by Ryan Naraine, 'security evangelist' - another meaningless phrase - at Kapersky Lab - can you say conflict of interest - at "11:19 am" on ZDNet all within the space of 24 hours.
Of particular interest is a phrase in a linked article (published some time on May 27) that states "At the moment these domains [Chinese hosted MPack sites] do not appear to be resolving"
I find it very suspicious that a 'dangerous' exploit was discovered on a 'Chinese' website, analysed, and made public all within the space of a day, and in the same day (presumably within a very few hours) the 'Chinese' had already taken the site offline. It's also suspicious that there are so few real details about when and how it was discovered.
Not new, but still funny:
http://www.xkcd.com/350/
Back in my day the only way to animate porn was flip the pages real fast. When technology does all the hard work for you, you lose any sense of personal accomplishment.
But what operating systems are affected and/or browsers? All of them? Some of them? Windows?
This advisory is fucking useless.
"This advisory is to alert you that if you are using Adobe Flash you're pretty much fucked, oh, there is no fix currently. Have a good day"
No, zero day exploit refers to the fact that the exploit is publicly disclosed (and in use) before there is a patch to fix it. So yes, tomorrow, this will STILL be a zero day exploit.
Modding Trolls +1 inciteful since 1999
SWF and other payload files cannot be uploaded and hosted on the compromised web server as easily as SQL-injecting a script fragment which downloads them from a 3rd party site in full control of the attacker. In this and all the recent mass-infection cases, the 3rd party hosts have been improbable domains Chinese domains likely registered ad hoc (such as wuqing17173.cn, woai117.cn or dota11.cn), and very unlikely to be in your NoScript whitelist, no matter how savage your browsing habits could be.
So in all "real world" scenarios seen so far, this one included, you are protected by NoScript in its default configuration, which blocks 3rd party embeddings even if you're visiting a trusted page.
Then if you want extra protection for the use cases you've listed (i.e. frequent usage of Flash-intensive community driven web sites), you can also configure NoScript to block ALL the embedded objects, with no regard for their origin: you will still be able to temporarily allow them selectively, by clicking on a visual placeholder.
There's a browser safer than Firefox, it is Firefox, with NoScript
"This threat should be considered very serious because of the widespread distribution that Adobe Flash enjoys on the Windows ecosystem"
.. :)
Shouldn't that be monoculture
davecb5620@gmail.com
Wow, nice job. You got it wrong too, in a post devoted to defining it.
It's the number of days after a security patch that an exploit is released that exploits the patched hole.
If a hole is exploited before the hole it takes advantage of is patched, or even known about, then it is a zero-day exploit.
tomorrow, this will STILL be a zero day exploit.
Which further supports my claim that the phrase is meaningless. It's an exploit with no 'patch' as of yet. Aren't all (working) exploits unpatched ?. When the patch (which probably isn't a 'patch' at all, but a new version of an application - binary patches are pretty rare ) arrives but is not deployed on a particular site, is that site a 'zero day' site still ? Does it become a "-X day" site ? On the day the the patch is released is the exploit named a X-Day exploit (X being elapsed days between discovery and patch), What happens the next day, does the name change again ?
Face it, the phrase is empty. For the love of Dog, please stop using it, it's driving me insane !!!!
Besides, isn't this just an Sql Injection exploit ? They've been around for years.
If that's your definition, ('zero day' == ) then it still hasn't been used correctly, since the linked article is already a day old. ...
and
Given that the phrase 'zero day' is made of two single syllable words
OneSmartFellow isn't today.
Put identity in the browser.
"Siverlight doesn't work on Macs or Linux, so there's no point porting the exploit there"
I thought it was a Flash vuln and don't you mean it doesn't work on Linux. As the exploit does uses generic browser redirection scripts and SQL-injection.
"Malware hunters have spotted a previously unknown - and unpatched - Adobe Flash vulnerability"
davecb5620@gmail.com
ya, now you're just mumbling incoherent gibberish. So sad. Either accept that your perceived definition was wrong, or stop talking about how you don't like what it doesn't mean.
The phrase is not meaningless, there is no reason to stop using it.
Modding Trolls +1 inciteful since 1999
"Adobe has to be the worst company ever to supply popular software for the web"
..
I do believe it's the flakey OS that is at fault here
davecb5620@gmail.com
Just check NoScript Options|Plugins|Apply these restrictions to trusted sites too. In this configuration, NoScript effectively replaces FlashBlock, and it works on plugins different from Flash as well.
There's a browser safer than Firefox, it is Firefox, with NoScript
Given that the phrase 'zero day' is made of two single syllable words ... ,/em>
Good catch - very funny !
OK, zero is indeed two syllables.
Odd, make me wonder what else does zero have in common with the letter 'W' and the number '7' ?
"This isn't the first or the last time Flash will have vulnerabilities discovered"
Do the designers of the OS bare any responcibility? What kind of a design allows remote code execution on a malformed media file? And this one happened by accident, does that mean that there are dozens of exploits out there waiting to be utilized by the criminal fraternity.
davecb5620@gmail.com
"Hey Adobe: Try Using Stack Canaries! (Score:5, Informative)"
..
How about building a stack that isn't vulnerable to stack exploits. And no - don't say it isn't possible. It just means the current batch of 'innovators' aren't able to manage it. So to summerise: x86 processor + Windows + Internet Explorer = the current fucked up security situation
davecb5620@gmail.com
Oh dear, looks like another one that can't read TFA..
The original poster is correct, as Zero day (as you explain) refers to the amount of time after a patch or update, that the vulnerability is exploited.
However multiple versions of adobe flash are affected by this meaning that it's at least a 162 day exploit...
(V9.0.115.0 release date is December 18, 2007)
Dopers are studid. Only stupid people live below sea level. The Dutch live below sea level. Ergo, the dutch a) live below sea level, b) are stupid, c) are dopers.
No, I am not french. I know the dutch are lazy dopers.
I'm certain there are plenty of backdoors in Flash, what better way for a shadow org in government to backdoor your Linux/Windows/Mac/Etc box? After all, most people use Flash, even if its just for YouTube or Tube8.
"but I use Linux! ha haa!" laughs the elite geek
"and Flash!" cries the wolf
"doh!" the geek whimpers, returning to jack it to bree
I'll just install the open source alternative to Flash on my Windows desktop...
Guess this is the moment for Gnash (http://www.gnu.org/software/gnash/) to shine!
Wow.. You sure spend a lot of energy talking crap.
Zero Day is just what the previous poster said. The exploit came out today, before being given to the company to get an update prior to it being released to public. Get with the program and let it be. Author was simply using the term that is widely used.
As far as the other crap in your post.. I'll simply let people read it and have a laugh at you.
I miss Macromedia. Sigh.
'x86 processor + Windows + Internet Explorer =' yet another linux snob who thinks they are better than everyone else because they use linux.
.Net does it for you. VS c++ makes it optional. Why would they do that? I have a 1 off application that is going to run for 20 days then be chucked. Do I need that check? Not really. It is a side effect of the call/return arch we use for just about every single computer made since the 70s.
DROP the attitude. The type of attack the dude was talking about is in just about every framework/system out there (including macs and linux and bsd). Java does it FOR you,
Not all appications are going out to the 'unwashed masses'.
Where would YOU propose we put local function variables? In some 'other memory area'? OH WAIT thats a stack. Even if you make it PER function you still have a stack. A small one but still a stack. You also need a bit of memory to tell you how to get back to where you were. And a bit of memory to put the registers back into a state that can be used by the caller function.
To 'fix' this 'type' of attack you would have 1 function copy per call. So that way you can just do a goto back to the correct spot of code. However that bloats code and blows processor cache to hell. So you might as well inline the WHOLE program. Come find me when you code runs 200x as slow as someone elses who doesnt do that.
Fuzzing and canaries are a EXCELENT way to find this sort of bug. Plus things like boundschecker and purify. It CAN be done. It takes work. You know, using that thing holding your ears apart. But you like to make grand statments of 'oh just do it MY way and it will be fixed'. Yet you do not say HOW to fix it.
Last Friday at work I was approached by a PM who was panicking: we lost the people who were working on Flash components for the corporate website. Someone was supposed to be flown from India to work on the component, but they couldn't make it for personal reasons. So the question was: can this be done in dynamic html? Well, of-course it can be done in dhtml, I said. It can look exactly like flash and do exactly what flash is doing. Some of the devs who were also working on Flash components, but who couldn't handle the Flash problem in this case, were insisting that it is in fact 'impossible' to do this, to make a dhtml component that would look and do exactly the same thing as Flash, and dhtml will not work in all browsers etc. 3 days later they were proven wrong.
In any case, my point is that Flash is an overkill for most GUIs on the web, it's good for video streaming, but even for that it is not absolutely necessary. However for whatever reason various dynamic functionality is often required by the business to be done within the browser. Something that cannot be done without some sort of scripting - sliding tabs, smooth transformations between images/text whatever. Such functionality is what browser side scripting is for. In order to be able to use this functionality at least javascript will have to be allowed. Whether anyone really wants to go to the website is a different question, but some websites provide useful functionality that is welcomed by the customers.
You can't handle the truth.
See also Symantec Threatcon here
So it looks as if you have the latest flash plugin (9.0.124) you may be ok.
Andy
"How about building a stack that isn't vulnerable to stack exploits", rs232
"Where would YOU propose we put local function variables?"
In other words, you for one don't know how to do it. The rest of your comments are so much attitudenal waffle.
davecb5620@gmail.com
Just how many accounts do you have .. :)
davecb5620@gmail.com
Quick! Everybody stop using flash!
The main problem that I find with SWFDEC is that their plugin functions the exact same way as the official flash :
it's a huge library containing a full fledged flash player that runs inside the same process as FireFox. Should Swfdec happen to crash (or every time the official flash crashes) it takes the whole browser with it.
Gnash on the other hand functions differently : it's a small library whose main function is to call the standalone player and embed it inside the webpage. When Gnash crashes, only that instance crashes. The browser (or any other instance of Gnash, for that matter) remain unaffected.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Starting from version 3, you can turn plugins on and off from the Addon menu without needing to restart the browser.
You can therefore use gnash for most of the usual browsing (Flash used for embedding fonts for titles, Flash used for menus) and turn on the official flash whenever you want something more heavy (Games or Flash animation that don't work with Gnash)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It refers to exploits where no patch is yet available. Your attempt to redefine it, again, to make it meaningless is not helpful. Most incidents where an exploit is successful are effecting machines that simply have not applied an available patch. These mostly hit home users using software that does not auto-update.
The term "zero day" is useful because it differentiates exploits where there is no available patch, which are of particular concern to security minded people, especially administrators. Zero day exploits are the ones where they have to do something other than test and install an update, or make sure it is already up to date. In the case of a zero day, they have to look for work-arounds, potentially disabling a service, or sending out a memo to users to tell them not to do something they might normally do. Because of this, the term "zero day" is a very, very useful term for security people and seeing it normally means it is a potentially serious issue they must address.
The problem is that the media saw the term, noticed people were attentive to it, and started using it as a synonym for "bad." Likewise, the unwashed masses have started to use it the same way, having seen the term in the media.
Face it, the phrase is empty. For the love of Dog, please stop using it, it's driving me insane !!!!The phrase is very useful for discussion among people who know what they're talking about. So for the love of Buddha, please stop misusing it, stop misinforming people about it, and why don't you stop misusing it yourself. Not all of us want our vocabularies dumbed down to the subset understandable by the least common denominator of society, nor do we want to have to use less precise language just because laypeople misuse a term.
People have been doing such kinds of things using Javascript for ages. There's no reason that, once video-embeding-standard becomes mainstream, Javascript ads will suddenly become not possible.
In fact people can even today put an "embed" video and use "Adsense" on the page (as long as either the pages is not empty and there are at least a couple of keywords, or there are enough cure from pages pointing to the video page). (See example of Javascript ads - even with a flash animation from Weeble's Stuff - here).
Facebook is another example of site which relies on Flash mostly for the player and uses its Ajax infrastructure for nearly anything else.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It once did, now it's used more generally, to mean an exploit that's in the wild and for which there is no patch currently available (the general meaning being you are vulnerable and cannot immediately fix it).
If you want explain why your more narrow definition is preferable to the current more general definition please feel free.
All I got from the article is that there is an "unspecified remote code-execution vulnerability". This doesn't necessarily mean a stack overflow. And while a 'stack canary' is a good security measure, it still doesn't protect against a stack overflow that overwrites local variables without touching the return address.
The reason I say this is that they may already be using these security measures. I know any version of Visual Studio that isn't prehistoric turns this feature (/GS) on by default.
Flash is an overkill for most GUIs on the web
.swf package can be done, even without a few hundred bucks worth of Adobe software, but it's more work than running "curl -o filename url" a few times. It's obfuscation, pure and simple.
Underline that, set it in boldface, carve it in granite, mod parent up, the works...
I really think the main reason people use flash is because it moderately increases the difficulty of reverse-engineering an interface. Chopping up a
Insists on having access to a Flash player, or it won't let me in.
"For 'Security' Reasons".
Now I have even more ammunition with which to criticize their "security". (this began when they recommended Internet Exploiter(tm)(r)(c) and the prevailing commercial "Operating System"s, and locked out me, with my Debian and IceWeasel: "IceWeasel? That's _not_ an approved browser!"
Hey, I know. I need a new bank. Does anybody know of one that's clueful enough to _not_ recommend IE?
Exceeding the recommended torque is not recommended.
https://addons.mozilla.org/en-US/firefox/addon/433
You are being MICROattacked, from various angles, in a SOFT manner.
An HTML proxy can protect you by directing all html to the proxy software first, which then filters it with Regular Expressions and fordwards the filter html page to the browser. I use an old program called Proxomitron with sidki's rule set (config file) and it stops flash and then allows you to start each one with a hyperlink style click. http://en.wikipedia.org/wiki/Proxomitron Of course its a Windows only util, but linux doesn't need it.
This was a known vulnerability that was fixed in 9.0.124.0 http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue_u_1.html Just make sure u upgrade.
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue_u_1.html
this has been fixed months ago. It is just an implementation of the vulnerability discovered by Mark Dowd.
Affected platforms: Windows 95-Vista, and everything in between.
http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-052714-3021-99
Even though the exploit does compromise Flash running on Linux or Mac, and even if the Windows trojan horse executable somehow worked on platforms other than Windows, there's still a matter of permissions keeping the malware from getting system-level access.
As far as Vista goes, the main thing I wonder about is if the exploit requires that the user give it permission to run through UAC. Even though UAC seems to be pretty useless in terms of only teaching users to click "allow" repeatedly to get anything done, it doesn't help at all if the compromised processes happen to be running under system level permissions anyway. I'd hope at the very least users would have to click 'allow' mindlessly to be infected by the trojan.