Every IT security website is publishing information related to the recent hack of the Hacking Team and consequent exfiltration of more than 400 GB of sensitive data. The most scaring scenario is already a reality, cyber criminals have started the integration of the exploits for Flash vulnerabilities yet unpatched in their crimeware kit, including the Neutrino EK.
“This is one of the fastest documented case of an immediate weaponization in the wild, possibly thanks to the detailed instructions left by Hacking Team.” Reported Malwarebytes.
The website “Malware Don’t Need Coffee”also reported that Angler EK and Nuclear EK mow includes the exploits for the new vulnerability targeted by the tools developed by the Hacking Team.
“As we were all expecting, integration in exploit kits was a matter of hours and it looks like Angler EK team is at it.”
The latest version of Mozilla Firefox is affect by the vulnerability:
At the time I’m writing almost no AV Company was able to detect the malicious code, besides Malwarebytes Anti-Exploit:
Fiddler and Neutrino have been also updated to include the new exploits, the attack scenario requests the installation of the vulnerability on a compromised website in order to infect visitors by exploiting the Adobe Flash bug and execute malicious arbitrary code on the targeted machine.
It is expected that today Adobe will release a fix to the vulnerability, but there are already workarounds to secure the systems, basically, you need to enable the “Click-to-Play” in all your browsers.
For that you just need to follow these steps:
Mozilla Firefox – Tools -> Addons -> Ask to Activate
Google Chrome – Settings page ->advanced settings->Content settings under Privacy->Click to play.
If you have the new version of Google Chrome, there are some small changes, settings are now called “Let me choose when to run plugin content”
Internet Explorer – select the Gear at the top of the page and Manage Add-ons.
Select Toolbars and Extensions – select All add-ons
Find Shockwave Flash Object plug-in and select “more information”
Click in “Remove all sites”
Safari – Safari menu-> Preferences-> Security-> Manage Website Settings
Select the pluggin and In “When visiting other websites” change to “Ask”
I hope this small tips can help you to prevent a dangerous situation.
About the Author Elsio Pinto
(Security Affairs – Hacking Team, zero-day)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.