Uma falha identificada e desconhecida no Adobe Flash está a ser explorada em ataques direcionados a vítimas da Coréia do Sul e será corrigida na semana de 5 de fevereiro.
A Adobe libertou hoje um relatório entregue pela equipa de resposta a incidentes de segurança da Coréia do Sul (KrCERT / CC) relativo à descoberta da vulnerabilidade de dia-zero no Flash Player ActiveX 28.0.0.137 e versões anteriores. O bug (CVE-2018-4878) descrito, é uma vulnerabilidade que permite a execução remota de código, de acordo com a publicação da Adobe.
Johannes Ullrich, chefe do SANS Internet Storm Center, diz o seguinte:
“The attack was rather limited, and targeted at individuals in South Korea who are involved in research about North Korea. I think this makes for a pretty strong case that this was a nation-state sponsored attack. Other actors would have little motivation to use a zero-day exploit in an attack against a group like this. On the other hand, it doesn’t have to be North Korea, given the difficulty of attribution.
Esta vulnerabilidade foi direcionada aos utilizadores do Windows e foi disseminada por e-mails atraves de documentos do office que contêm conteúdo flash incorporado. De acordo com a Adobe, numa investida bem sucedida, o atacante poderia tomar o controlo total do computador da vítima.
Os produtos afetados são os seguintes:
Adobe’s Flash Player Desktop Runtime on Windows and Mac; Flash Player for Google Chrome on Windows, Mac, Linux, and Chrome OS; Flash for Microsoft Edge and Internet Explorer 11 on Windows 10 and 8.1; and Flash Player Desktop Runtime on Linux
Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.
Read more here.