Adobe Acrobat 0-day Analysis

So as promised in my earlier post, I have started the analysis of the exploit, and here are some details thus far. The exploit is affecting Adobe Reader and Acrobat 9.2 and earlier.
When the malicious PDF file is opened in Adobe Acrobat/Reader it attempts to download an executable payload.
The payload I analyzed was downloaded from hxxp://foruminspace.com/documents/dprk/
This server looks like it has been taken down a few times since about 6am EST this morning but is back up.
The executable, once downloaded searches for and encrypts certain files and then uploads them to another server. This server is online and its contents are publicly browsable.

Based on the number of files found on the upload server, it appears that this exploit is only targeting specific attacks at this time, however this may change at any point.

Adobe Patch schedule is quarterly, with security patches coming as needed on the same release and Microsoft patches, using this patching SOP it could be January 12th before Adobe pushes out a patch.

The exploit I detected as Exploit:W32/AdobeReader.Uz
The downloader files as Trojan-Dropper:W32/Agent.MRH
The Dropped files as Trojan:W32/Agent.MRI, Trojan:W32/Agent.MRJ, and Rootkit:W32/Agent.MRK

At this point I would recommend using altrenative PDF readers, or disabling the javascript option within Adobe products as a temporary remediation.

http://www.adobe.com/support/security/advisories/apsa09-07.html

New Adobe Acrobat /Reader 0-day Exploits

This just came across my desk so I figured I would post a short informational piece for those of you who are using the mentioned Adobe products.
The 0-day has been active since about 2 weeks ago from some of the code samplings I have seen thus far and has now been brought to the attention of the vendor, so with that the we can expect to see a patch soon I would hope.
The Exploit allows an attacker to craft a malicious PDF and upon being opened on a vulnerable version of the Adobe software will allow the execution of arbitrary code. this may allow an attacker to take complete control of the affected system. No patch is currently available and A proof of concept module has been added to the Metasploit framework. I will be playing with this POC module in the days to come and have additional details at a more in depth technical level.
Happy Patching / Updating.

Facebook Phishing - Cant Trust your "FRIENDS"

As I start to write this I am as comfortable as one can be on an airline seat with laptop in front of me, I’ve been reflecting a little on another interesting week in information security and somewhat trying to settle into this blog writing gig. At the request of a very special reader that I was conversing with regarding this somewhat interesting but now common place finding on facebook, I decided to share the following.



As I was trolling facebook earlier this week I came across a posting on a friends page, that is pictured to the left. Upon seeing this posting I decided to do a little digging as the use of shortened url’s has become the norm thanks to twitter links. Upon clicking on the link users were redirected to what appeared to be a facebook login page at 1st glance, however upon looking at the browser URL the shortened link provided in the original posting directs users to a site named hxxp://phasebooklogine.t35.com this site is hosted on a free and quick and easy to setup hosting site named t35.com



This image shows what the login page looks like and as you can see it’s a somewhat convincing page unless you look closer. Most user would type in their credentials without thinking twice, due to what I call blind faith in what appears to be something originating from a “friend”

This site is another example of just one of the attack vectors that are currently widely disbursed on all social networking sites, primarily myspace, facebook, youtube, and twitter. This vector here of course is a modified approach to your standard phishing attacks, phishing attacks usually come in the form of emails from your bank, your friend , etc and use the same tactic of harvesting user credentials via an authentic looking login page that in some instances will do nothing after you enter your creds, and in other cases will forward you on to the legitimate site.

In the case of phasebooklogine.t35.com upon entering any credentials the page would direct you to one of about 5 randomized seemingly legitimate facebook apps.

Consider this part one of this facebook analysis article specific to posted phishing attacks, I will be writing a followup article with more technical details as to my analysis.