Patch Now: Adobe Flash Zero-Days Spread Via Spam

Security researchers observed a widespread and ongoing spam campaign that uses malicious documents to abuse two Flash zero-day vulnerabilities that can allow remote code execution (RCE) and insecure library loading (DLL hijacking). Adobe has deployed the patches needed, but users and companies using legacy systems are advised to update their systems as soon as possible.

[Read: Virtual Patching: Patch those vulnerabilities before they can be exploited]

The spam campaign distributes the malicious documents via web page downloads, email and instant messaging. A socially engineered email or message is sent to the user containing a .RAR compressed file with a .JPG and Microsoft Word document disguised as an application survey. Opening the document enables the Flash ActiveX control hidden and embedded within the document, displaying a prompt that unpacks the exploit.

Once played, the ActiveX executes the accompanying payload — backup.exe decompressed from inside “scan042.JPG,” supporting shellcodes for 32-bit and 64-bit systems. The payload is a remote access trojan (RAT) extracted from the .JPG to collect system information via HTTP POST, as well as take advantage of the two possible flaws. CVE-2018-15982 can be used for remote code execution and gain admin rights to the infected system once communication to the command and control server (C&C) is established. Meanwhile, CVE-2018-15983 can be used for DLL hijacking for privilege escalation through Flash.

Aside from the .JPG housing the executable file as a possible means to avoid detection, the payload uses VMProtect, a technique previously seen being used to prevent blocking and reverse engineering efforts. The technique is reminiscent of the maneuver employed by the Hacking Team earlier this year.

[Read: Patch now: New Mirai, Gafgyt variants target 16 flaws via multi-exploits]

Most systems no longer require Flash to load media such as documents, games and videos. Technology trend usage of Flash is on a constant angled decline, as opposed to other programming languages such as JavaScript and Silverlight. However, Microsoft Office and other legacy systems can still load and execute Flash content, allowing vulnerabilities in the software to remain available as an exploit vector. The critical flaw affects Adobe Flash Player Desktop Runtime, Adobe Flash Player for Google Chrome, Microsoft Edge and Internet Explorer 11, all versions of Adobe Flash Player 31.0.0.153 and earlier, and Adobe Flash Player Installer versions 31.0.0.108 and earlier. Adobe was reportedly notified on November 29, and were informed of the deployed solutions promptly.

[Read: Patching problems and how to solve them]

Cybercriminals will continue finding loopholes for attacks, especially in enterprises that continue to use legacy operating systems. There are still ways to protect your system:

• Update your systems with the latest patches to prevent abuse of vulnerabilities.
• If patches are unavailable, make sure to download available virtual patches.