Adobe confirms flash 0-day, issues security bulletin | Hacker News Reader

Adobe confirms flash 0-day, issues security bulletin

adobe.com

13 pointstrotsky12 comments

Background on the advisory: http://krebsonsecurity.com/2011/04/new-adobe-flash-zero-day-...

According to sources, the attacks exploit a vulnerability in fully-patched versions of Flash, and are being leveraged in targeted spear-phishing campaigns launched against select organizations and individuals that work with or for the U.S. government. Sources say the attacks so far have embedded the Flash exploit inside of Microsoft Word files made to look like important government documents.

Here's a virustotal scan of one of the documents: http://www.virustotal.com/file-scan/report.html?id=1e677420d...

The fact that one AV engine detected it as a 0-day was the source of admonishments or congratulations depending on where the observers stood. Until it was discussed that the one detection was probably an unrelated false positive.

~~~

Additional artifacts from the attack including the spearphising tease and the times they were being sent (early morning friday apr 8) - at the height of the budget battle.

http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611...

I think it's worth pointing out that this vulnerability is being exploited by people opening Word docs (on Windows) that they get via a phishing email. The last 0-day exploit against Flash that I saw posted on HN was the same thing but for a swf embedded in Excel. Not that these things aren't bad, but saying "Flash 0-day" sounds an awful lot more doomsday-ish than "0-day exploit if you open an attachment from a phishing email". Not trying to make excuses for Adobe, but people around here are pretty quick to jump on the overly-dramatic bandwagon when it comes to Flash.

Agreed. There some fear-mongering with that type of headline.

Of course, I had no idea that flash could even be embedded in Office applications.

I mean... they just want to look responsible. If they'd toned it down, people would have accused them of not taking things seriously enough. It's better for them to seize the situation and own it rather than let the press have a field day and then spend time having to explain themselves. That's just my 2c...

Support for embedding ActiveX controls in documents has been there since Office 97.

This is not overly dramatic. Flash can now compromise your entire computer simply by your browser being directed at malicious content. It may be a search result, or a link, or an email... you click, and your entire computer is compromised. All your data could instantly disappear. All your money could be drained from your bank account.

Remote exploits that require no abnormal user action are fucking serious.

But that's not what the exploit is. It's an exploit against a swf file embedded in a Word doc. So you have to open a bad Word doc. There's no evidence to suggest "you click, and your entire computer is compromised". This isn't just any random swf file on the web that you access with a browser (ie a search result or link). Instead it's "you get sent a shady email with an attachment, you ignore your better judgement about not opening shady attachments in emails, and then you're compromised".

This flaw was packaged in a doc and spear-phished to specific people to achieve a specific goal. You are confusing features like "embedded in a .doc" and "unregulated by things like flashblock or noscript" with a limitation.

While the initial attack is uninterested in you, these things spread widely. There is nothing that has been reported that suggests it is limited to this delivery vehicle - I would assume it is not. In my experience, 2nd or 3rd order exploitations will be active before an adobe fix is released.

I think his point was that this exploit was done outside of a browser sandbox, which places it in a whole new category of security issues. You could just as easily say this is microsofts fault for not applying stricter policies on activex controls within office products.

Happy thank-goodness-I-removed-flash day. One of the best holidays, since I get to celebrate it so many times a year..

"...and are being leveraged in targeted spear-phishing campaigns launched against select organizations and individuals that work with or for the U.S. government"

Perhaps you work for or with the U.S. Government. Information leakage is fun! ;-)

Man, Flash is like Windows 98 back in the day. Time to take the plunge and uninstall.

Reply on news.ycombinator.com