Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ISC StormCast for Tuesday, March 6th 2012 http://isc.sans.edu/podcastdetail.html?id=2371

Adobe Flash Player Security Update

Published: 2012-03-05
Last Updated: 2012-03-05 20:05:01 UTC
by Johannes Ullrich (Version: 1)
5 comment(s)

Adobe today released bulletin with details regarding two new vulnerabilities in Adobe Flash Player [1]. The vulnerabilities can lead to arbitrary code execution and affects all platforms (don't forget Android and Google Chrome patches!).

There is no indication at this point that the vulnerability has been exploited yet. However, I believe this is an unannounced out-of cycle release. 

Also note that twitter is littered with links to various "adobe updates" with suspect destinations. Only download adobe updates using Adobe's own update tools or use the Adobe site itself.

Thanks all the readers who alerted us about this issue. It took a little bit long to publish this diary in part as I first needed to verify that the update is valid. The security bulletin below isn't link yet from Adobes bulletin overview page.

http://www.adobe.com/support/security/bulletins/apsb12-05.html

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

5 comment(s)

Flashback Malware now with Twitter C&C

Published: 2012-03-05
Last Updated: 2012-03-05 19:33:08 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

The OS X malware family Flashback is making news again. This time around, antivirus vendor Intego uncovered a new version of Flashback that will use Twitter as a command and control channel [1]. The malware will check twitter for daily changing hashtags to look for commands.

Today's hashtag, #pepbyfadxeoa, has already been heavily "abused" on twitter. Given all the additional posts, it isn't really clear if the actual command will be parsed correctly by the bot.

Overall, the twitter channel isn't exactly implemented very strongly. For example, Intego points out that the bot will use specific, but alternating, user agents to hide. However, some of these user agents are pretty easy to spot. Hiding in plain sight only works if you are actually trying to blend in and not lighting yourself with a big flare.

So far, we haven't seen any first hand reports of the infection. If anybody runs across a sample, let us know. I would like to test if Apple's XProtect software adds a signature for it, or if existing signatures cover this one. Apple has been steadily updating the XProtect signatures, but it is not always if it covers version reported by other vendors as the naming is not always in sync. According to my monitoring of XProtect, it was last updated February 7th.

[1] http://blog.intego.com/flashback-mac-malware-uses-twitter-as-command-and-control-center/

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: flashback os x virus
1 comment(s)
Diary Archives