Hacking Team Flash Zero-Day exploits are being used in the wild

July 8, 2015  By Pierluigi Paganini


Security experts confirmed that Adobe Flash vulnerability revealed in the recent attack against the Hacking Team is being used in the wild.

Every IT security website is publishing information related to the recent hack of the Hacking Team and consequent exfiltration of more than 400 GB of sensitive data. The most scaring scenario is already a reality, cyber criminals have started the integration of the exploits for Flash vulnerabilities yet unpatched in their crimeware kit, including the Neutrino EK.

“This is one of the fastest documented case of an immediate weaponization in the wild, possibly thanks to the detailed instructions left by Hacking Team.” Reported Malwarebytes.

The website “Malware Don’t Need Coffee”also reported that Angler EK and Nuclear EK mow includes the exploits for the new vulnerability targeted by the tools developed by the Hacking Team.

“As we were all expecting, integration in exploit kits was a matter of hours and it looks like Angler EK team is at it.”

Hacking team exploits 

The latest version of Mozilla Firefox is affect by the vulnerability:

Hacking team exploits 2

At the time I’m writing almost no AV Company was able to detect the malicious code, besides Malwarebytes Anti-Exploit:

Hacking team exploits 3

Fiddler and Neutrino have been also updated to include the new exploits, the attack scenario requests the installation of the vulnerability on a compromised website in order to infect visitors by exploiting the Adobe Flash bug and execute malicious arbitrary code on the targeted machine.

It is expected that today Adobe will release a fix to the vulnerability, but there are already workarounds to secure the systems, basically, you need to enable the “Click-to-Play” in all your browsers.

For that you just need to follow these steps:

Mozilla Firefox – Tools -> Addons -> Ask to Activate

Hacking team exploits 4.png

Google Chrome – Settings page ->advanced settings->Content settings under Privacy->Click to play.

Hacking team exploits 4

If you have the new version of Google Chrome, there are some small changes, settings are now called “Let me choose when to run plugin content”

Hacking team exploits 5

Internet Explorer – select the Gear at the top of the page and Manage Add-ons.

Select Toolbars and Extensions – select All add-ons

Find Shockwave Flash Object plug-in and select “more information”

Hacking team exploits 6

Click in “Remove all sites”

Hacking team exploits 7

Safari – Safari menu-> Preferences-> Security-> Manage Website Settings

Select the pluggin and In “When visiting other websites” change to “Ask”

Hacking team exploits 8

I hope this small tips can help you to prevent a dangerous situation.

About the Author Elsio Pinto

Elsio Pinto (@high54security) is at the moment the Lead McAfee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog McAfee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog McAfee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog http://high54security.blogspot.com/

 

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Hacking Team, zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]

 



Pierluigi Paganini
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.





You might also like





  • Digging the Deep Web: Exploring the dark side of the web

    Digging The Deep Web

  • Center for Cyber Security and International Relations Studies

  • Subscribe Security Affairs Newsletter

    newsletter

  • SecurityAffairs awarded as Best European Cybersecurity Tech Blog at European Cybersecurity Blogger Awards

    EU Sec Bloggers Awards 22


More Story

Linux, Apache, MySQL is all that evil XKeyscore needs to control the world

 According to new revelations of the popular whistleblower Edward Snowden the powerful spying machine XKEYSCORE runs on Red Hat Enterprise...