Nasty PDF exploit runs wild
Coming to an inbox near you
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
A day after Adobe patched a serious security hole in its Reader and Acrobat programs, miscreants are flooding email inboxes with malware-tainted PDF files that try to remotely hijack vulnerable computers.
The malware, identified by Symantec researchers as Trojan.Pidief.A, is included in PDF files attached to a "fair number of emails," according to this blog entry. The spam typically targets specific businesses or organizations.
Adobe issued a patch for the vulnerability on Monday. The revelation of in-the-wild exploits underscores the importance of updating immediately. A patch for Reader is available here; an Acrobat update is available here.
Emails typically arrive bearing subjects such as "invoice," "statement" or "bill" and contain no text in the body. If the attached PDF is opened using a vulnerable version of Adobe software, the machine will execute code that lowers Windows security settings and installs a bevy of nasty malware, according to the SANS Internet Storm Center.
At least some of the spam comes courtesy of the Russian Business Network, a St. Petersburg-based service provider that offers bullet-proof hosting to criminals engaged in child pornography, identity theft and spam, according to Ken Dunham, director of global response at iSIGHT Partners. "The code and servers used in the attack are nearly identical to September 2006 Vector Markup Language (VML) zero-day attacks that took place one year ago," he wrote in an email.
For more information about the Russian Business Network and how it operates, check out this article published by The Washington Post. ®
COMMENTS
My, my, there is a lot of confusion here...
Steve: The address of the Russian Business Network is http://www.rbnnetwork.com/ - but I strongly discourage you from trying to block that from your hosts file. Hint: ping it to see what IP address it resolves to. (Anybody else - if you don't know what that IP means, don't mess with it, because you're going to cut off your connection to the Internet.)
Costa Mihalidis: Word (and Excel, and PowerPoint) documents are dangerous to open even if they do *not* contain macros. There are many exploits in these applications that allow the execution of malicious code even from macro-less documents.
Oh, and everybody: This is *not* an Acrobat exploit! Acrobat's only fault is allowing automatic execution of embedded URLs (instead of you having to click on them manually). The vulnerability is in Internet Explorer 7 on Windows XP machines. Acrobat is just an attack vector. Adobe patching it closes this attack vector - but the very same vulnerability can be exploited from other applications - Firefox (already patched), Skype (already patched), mIRC, Miranda, etc., etc. We're still waiting for Microsoft to patch the root of the problem. :-(
Anonymous Coward & Chris Ovenden: Foxit is vulnerable to this exploit too! The only difference is that Acrobat runs it automatically, while with Foxit you have to be tricked to click on an URL in the document.
Pascal Monett: The RBN does not break any Russian laws, so the Russian police cannot do anything about it. Only its *customers* break laws - and the police does what it can. While what the RBN does is certainly unethical, prosecuting them is no different than prosecuting the phone company for allowing some of its (probably criminal) customers to use encrypted mobile phone communications.
A J Stiles: Open source software for PDF viewing won't save you from this exploit, if you have IE7 installed on a WinXP machine.
Glenn Gilbert: This exploit is in IE7/WinXP - that's why there is no Acrobat update for Linux and Mac. The exploit doesn't work there.
RBN isn't the Russia
RBN isn't the Russia and crime has no nationality. I would suggest addressing this given 'gray' ISP, RBN, without using it as a synonym for Russia.
!. @ JP @Angela 2. @ Ken 3. @all discussing vulnerability
1. Straying off into religion / faith. Bush, Blair may or may not be driven by 'greed' (a term that may require further refinement); however, this does not mean that they are not also driven by their faith. They have both publicly declared that they are so driven. In my personal opinion people of faith who also seek political power need to demonstrate the intrellectual horsepower to *separate* the two - not combine them, as these 2 dangerous people have done.
2. Ken, when Morley Dotes writes, e.g. 'deny from 81.95.144.0/22' you can take it to mean 'block all inbound traffic from that IP range', i.e. 'blocking Russian IP addresses' will stop everything including 'you accidently viewing Russian web sites'. Blocking outbound requests also helps ;-)
3. Agree with AJ S when he writes: "The statement "requires Acrobat Reader" which often accompanies PDFs on web sites is just flat-out untrue"; however AJS's open-source advocacy (proselytising) needs also to be taken with a pinch of ('show the evalaution report!') salt.
Morten Ranulf Clausen's 2 facts are apposite; my suggestion to address his invitation to 'discuss the infrastructure to handle it' is the classic security engineering approach: Layered Defence (aka Defence in Depth).
Defence at the application layer (buy applications with a proven behaviour {admittedly, not universally available}). Defence at the network interior layer: appropriate corporate security policies (expressed, understood, monitored, enforced) about acceptable use, principle of least privilege, host-based intrusion detection and alerting, locked-down host computer configurations, network-based intrusion detection, heuristic analysis, automated alert & response, anti virus. Defence at the corporate boundary: firewalls (stateful, deep packet inspection), AV, content and application proxies. Defence at the ISP / service provider layer (duplicating all approaches already listed). Use a 3rd party service provider for mail filtering (perhaps).
Downsides?
A.It all costs a bundle
B. Will take everybody (everybody!) *years* to implement it all; especially the
"applications with a proven behaviour" & "defence at the ISP / service provider layer" bits - I admit that.
In summary: in the meantime - good luck to you all and plenty of work for me for years to come.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
