Feeds

Miscreants hijacking machines via (freshly patched) Adobe flaw

Is yours next?

  • alert
  • submit to reddit

3 Big data security analytics techniques

If you haven't updated your Adobe Reader program lately, now would be a good time. Three days after the company rushed out a critical update, miscreants are actively exploiting a security flaw to execute malicious code on vulnerable machines.

The SANS Internet Storm Center says here that researchers have spotted laced PDF files being circulated online. Its discovery comes on the heels of the public release of proof-of-concept code exploiting CVE-2008-2992. According to SANS, none of the 32 top anti-virus programs were detecting the malicious files.

SANS handler Bojan Zdrnja said the PDFs are being spread using drive-by advertisements on sites deemed "suspicious." At the moment, distribution is fairly light, but Zdrnja expects that change soon. Once the rigged PDF is opened, the exploit calls the mshta application in Windows to execute HTA files.

"It retrieves the trojan from a different web site and executes it on the infected machine," Zdrnja wrote in an email to The Register. "The trojan then does all sort of malicious things (I haven't analyzed that further)."

Like Adobe's Flash animation player, Reader can be a pain to keep updated. The program comes with an automatic update feature, but it sometimes takes weeks to actually get around to installing critical updates, we've found. Whether your machine runs Windows, OS X, or Linux, manual updating is fairly easy using this link. Versions 8.1.2 and earlier are vulnerable to these attacks. Protect yourself by patching now. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.