Purported Iran nuke document contains trojan

Powered by SC Magazine
 

Spreads via Flash vulnerability.

Targeted attackers are leveraging a patched Adobe Flash vulnerability and the ongoing tension around Iran's suspected nuclear program to spread a difficult-to-detect trojan.

Emails were spreading that contained a Word document titled "Iran's Oil and Nuclear Situation", according to Contagio Malware Dump, a malware sample collection site.

Clicking on the file sets in motion a series of events that ultimately results in a malicious binary being dropped onto the target system.

"The Word document contains Flash, which downloads a corrupted MP4 file," wrote Contagio IT specialist Mila Parkour in a blog posted Monday. "This MP4 file causes memory corruption and code execution."

The attack takes advantage of a recently fixed Flash bug (CVE-2012-0754). The vulnerability was repaired, along with six others, last month when Adobe released Flash Player 11.1.102.62 for Windows, Macintosh, Linux and Solaris.

Just seven of 42 of the most popular anti-virus products on Saturday had detected the malicious file, according to a VirusTotal review commissioned by Contagio.

Reached by email, Parkour said "someone donated the sample and sounds like a lot of them are already in circulation." An Adobe spokeswoman said the company didn't have any information about the extent of the threat.

Adobe also released another Flash update (11.1.102.63)  to address two critical vulnerabilities. The flaws garnered "Priority 2" status under Adobe's newly launched ratings system. Priority 2 means there are no known exploits for any of the bugs being fixed, nor are attacks imminent.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Purported Iran nuke document contains trojan
 
 
 
Top Stories
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Images: the next frontier in data analytics?
Barclay’s global data chief says we’re still at the starting line.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  26%
TOTAL VOTES: 431

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 206

Vote