Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Targeted attackers are leveraging a patched Adobe Flash vulnerability and the ongoing tension around Iran's suspected nuclear program to spread a difficult-to-detect trojan.
Emails were spreading that contained a Word document titled "Iran's Oil and Nuclear Situation", according to Contagio Malware Dump, a malware sample collection site.
Clicking on the file sets in motion a series of events that ultimately results in a malicious binary being dropped onto the target system.
"The Word document contains Flash, which downloads a corrupted MP4 file," wrote Contagio IT specialist Mila Parkour in a blog posted Monday. "This MP4 file causes memory corruption and code execution."
The attack takes advantage of a recently fixed Flash bug (CVE-2012-0754). The vulnerability was repaired, along with six others, last month when Adobe released Flash Player 184.108.40.206 for Windows, Macintosh, Linux and Solaris.
Just seven of 42 of the most popular anti-virus products on Saturday had detected the malicious file, according to a VirusTotal review commissioned by Contagio.
Reached by email, Parkour said "someone donated the sample and sounds like a lot of them are already in circulation." An Adobe spokeswoman said the company didn't have any information about the extent of the threat.
Adobe also released another Flash update (220.127.116.11) to address two critical vulnerabilities. The flaws garnered "Priority 2" status under Adobe's newly launched ratings system. Priority 2 means there are no known exploits for any of the bugs being fixed, nor are attacks imminent.
This article originally appeared at scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.