Menu
Cybercriminals adopt recently patched zero-day exploit in a flash

Cybercriminals adopt recently patched zero-day exploit in a flash

It only took four days for a recently patched vulnerability in Flash Player to start being used in large-scale attacks

Just four days after Adobe Systems patched a vulnerability in Flash Player, the exploit was adopted by cybercriminals for use in large-scale attacks. This highlights the increasingly small time frame users have to deploy patches.

On Saturday, a malware researcher known online as Kafeine spotted a drive-by download attack done with the Magnitude exploit kit that was exploiting a Flash Player vulnerability patched Tuesday.

The flaw, tracked as CVE-2015-3113 in the Common Vulnerabilities and Exposures database, had zero-day status -- that is, it was previously unpatched -- when Adobe released a patch for it. It had already been exploited by a China-based cyberespionage group for several weeks in targeted attacks against organizations from the aerospace, defense, construction, engineering, technology, telecommunications and transportation industries.

It is not unusual to see zero-day exploits for Flash Player and other popular applications being used in highly targeted cyberespionage attacks. That's because the goal of the attackers behind them is to compromise organizations that sometimes have sophisticated defenses and to remain undetected for as long as possible.

On the other hand, while zero-day exploits have been used in more indiscriminate, large-scale attacks, such incidents are rare. That's because zero-day vulnerabilities are extremely valuable and it doesn't make financial sense for attackers to burn them in noisy campaigns where they'll be very quickly discovered and patched.

Therefore, it's much more common for the creators of commercial exploit kits like Magnitude to integrate exploits for already patched vulnerabilities. For them it's a numbers game and there's always a large number of users who fail to install updates in a timely manner if at all.

But it seems that while computer users have not significantly improved their patching times, the exploit kit creators are aggressively reducing the time they need to integrate exploits.

The new Magnitude attacks left users with only four days to install the Flash Player patch for CVE-2015-3113, a very small time frame especially for organizations that typically deploy updates according to predetermined schedules that are often more than one week apart.

Earlier this year the authors of another exploit kit, Nuclear EK, integrated a Flash Player exploit a week after Adobe patched it, signaling a trend toward increasingly smaller patch windows.

The new Magnitude attacks that exploit CVE-2015-3113, if successful, install the Cryptowall ransomware. However, the payload could be changed by the attackers to something else at any time.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags patchessecurityAdobe Systemspatch managementExploits / vulnerabilitiesmalware

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments