Drive-By Downloads Attack Adobe Zero-Day Flaw

Adobe released a security advisory www.mcafee.com/activate warning the users of a zero-day vulnerability www.mcafee.com/activate download in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit targeting this vulnerability was embedded inside Microsoft Excel documents and was used to deliver the malicious code www.mcafee.com/activate product key to the victims. McAfee Labs performed a detailed technical analysis of the exploit and  mcafee.com/activate product key learned that the Flash Player object embedded inside www.mcafee/activate the Excel document carried the malicious shellcode (shown below), which in turn loaded another Flash object to exploit the vulnerability via the classical heap-spray technique.

 

A couple of weeks ago we came across another variation in this attack via a drive-by download through a compromised mcafee.com/activate product key web server.

In a drive-by download www.mcafee.com/activate download, a user visits a legitimate www.mcafee/activate but infected web page and is redirected to a malicious server. Most of these infections are malicious iframes injected into a JavaScript exploit on the www.mcafee.com/activate compromised web server, resulting in the malware installing www.mcafee.com/activate product key itself onto the user’s machine. This is a common and widely known attack method.

A drive-by download usually goes like this:

This insertion will make the www.mcafee.com/activate product key browser request www.mcafee/activate the JavaScript exploit from the compromised server, which in turn  www.mcafee.com/activate contains the links to www.mcafee.com/activate download the malicious server mcafee.com/activate product key.

Key findings in the CIP report

• Eighty percent of respondents have faced a www.mcafee/activate large-scale denial of service attack
• Twenty-five percent of respondents have been victims of extortion attempts
• More than 40 percent of www.mcafee.com/activate product key executives believe that www.mcafee/activate their industry’s vulnerability has increased
• Almost 30 percent believe www.mcafee.com/activate download their company is not prepared for a cyberattack
• More than 40 percent expect a major cyberattack within the next year
• Energy sector mcafee.com/activate product key increased its adoption of  www.mcafee/activate security technologies by only a single percentage point, at 51 percent
• Oil and gas industries increased www.mcafee.com/activate by only three percentage points, at 48 percent
• Nearly 70 percent of respondents www.mcafee.com/activate download frequently found mcafee.com/activate product key malware www.mcafee/activate designed to sabotage their systems
• A quarter of respondents www.mcafee.com/activate product key reported daily or weekly DDoS attacks

 

Looking into the content of the www.mcafee.com/activate JavaScript exploit, we see the embedded iframe source that  mcafee.com/activate product key redirects www.mcafee.com/activate download the browser to the malware-hosting web server, www.mcafee/activate from which the exploit www.mcafee.com/activate product key downloads the malicious Adobe Flash files.