Abode Reader 10/11 sandbox bypassed by zero-day exploit

Adobe confirms zero-day exploit bypasses Adobe Reader sandbox

Lucian Constantin
Feb 14, 2013 5:55 AM
http://www.pcworld.com/article/2028163/adobe-confirms-zeroday-exploit-bypasses-adobe-reader-sandbox.html

A recently found exploit that bypasses the sandbox anti-exploitation protection in Adobe Reader 10 and 11 is highly sophisticated and is probably part of an important cyberespionage operation, the head of the malware analysis team at antivirus vendor Kaspersky Lab said.

The exploit was discovered Tuesday by researchers from security firm FireEye, who said that it was being used in active attacks. Adobe confirmed that the exploit works against the latest versions of Adobe Reader and Acrobat, including 10 and 11, which have a sandbox protection mechanism.

“Adobe is aware of reports that these vulnerabilities are being exploited in the wild in targeted attacks designed to trick Windows users into clicking on a malicious PDF file delivered in an email message,” the company said in a security advisory published Wednesday.

Adobe is working on a patch, but in the meantime users of Adobe Reader 11 are advised to enable the Protected View mode by choosing the “Files from potentially unsafe locations” option under the Edit > Preferences > Security (Enhanced) menu.

The exploit and the malware it installs are super high-level, according to Costin Raiu, director of Kaspersky Lab’s malware research and analysis team. “It’s not something you see every day,” he said Thursday.

Judging by the sophistication of the attacks, Raiu concluded that they must be part of an operation of “huge importance” that “would be on the same level with Duqu.”

Duqu is a piece of cyberespionage malware discovered in October 2011 that’s related to Stuxnet, the highly sophisticated computer worm credited with damaging uranium enrichment centrifuges at Iran’s nuclear plant in Natanz. Both Duqu and Stuxnet are believed to have been created by a nation state.

The latest exploit comes in the form of a PDF document and attacks two separate vulnerabilities in Adobe Reader. One is used to gain arbitrary code execution privileges and one is used to escape from the Adobe Reader 10 and 11 sandbox, Raiu said.

The exploit works on Windows 7, including the 64-bit version of the operating system, and it bypasses the Windows ASLR (address space layout randomization) and DEP (Data Execution Prevention) anti-exploitation mechanisms.

When executed, the exploit opens a decoy PDF document that contains a travel visa application form, Raiu said. The name of this document is “Visaform Turkey.pdf.”

The exploit also drops and executes a malware downloader component that connects to a remote server and downloads two additional components. These two components steal passwords and information about the system configuration, and can log keystrokes, he said.

The communication between the malware and the command-and-control server is compressed with zlib and then encrypted with AES (Advanced Encryption Standard) using RSA public-key cryptography.

This type of protection is very rarely seen in malware, Raiu said. “Something similar was used in the Flame cyberespionage malware, but on the server side.”

This is either a cyberespionage tool created by a nation state or one of the so-called lawful interception tools sold by private contractors to law enforcement and intelligence agencies for large sums of money, he said.

Kaspersky Lab doesn’t yet have information about this attack’s targets or their distribution around the world, Raiu said.

Reached via email on Wednesday, FireEye’s senior director of security research, Zheng Bu, declined to comment on the attack’s targets. FireEye published a blog post with technical information about the malware on Wednesday, but didn’t reveal any information about victims.

Bu said that the malware uses certain techniques to detect if it’s being executed in a virtual machine so it can evade detection by automated malware analysis systems.

  • Researchers: Zero-day PDF exploit affects Adobe Reader 11, earlier versions

    Lucian Constantin
    Feb 13, 2013 10:35 AM
    http://www.pcworld.com/article/2027946/researchers-zero-day-pdf-exploit-affects-adobe-reader-11-earlier-versions.html

    Researchers from security firm FireEye claim that attackers are actively using a remote code execution exploit that works against the latest versions of Adobe Reader 9, 10 and 11.

    “Today, we identified that a PDF zero-day [vulnerability] is being exploited in the wild, and we observed successful exploitation on the latest Adobe PDF Reader 9.5.3, 10.1.5, and 11.0.1,” the FireEye researchers said late Tuesday in a blog post.

    The exploit drops and loads two DLL files on the system. One file displays a bogus error message and opens a PDF document that’s used as a decoy, the FireEye researchers said.

    Remote code execution exploits regularly cause the targeted programs to crash. In this context, the fake error message and second document are most likely used to trick users into believing that the crash was the result of a simple malfunction and the program recovered successfully.

    Meanwhile, the second DLL installs a malicious component that calls back to a remote domain, the FireEye researchers said.

    It’s not clear how the PDF exploit is being delivered in the first place—via email or over the Web—or who were the targets of the attacks using it. FireEye did not immediately respond to a request for additional information sent Wednesday.

    “We have already submitted the sample to the Adobe security team,” the FireEye researchers said in the blog post. “Before we get confirmation from Adobe and a mitigation plan is available, we suggest that you not open any unknown PDF files.”

    The Adobe Product Security Incident Response Team (PSIRT) confirmed Tuesday in a blog post that it is investigating a report of a vulnerability in Adobe Reader and Acrobat XI (11.0.1) and earlier versions being exploiting in the wild. The risk to customers is being assessed, the team said.

    In response to a request for a status update sent Wednesday, Heather Edell, Adobe’s senior manager of corporate communications, said that the company is still investigating.

    Sandboxing is an anti-exploitation technique that isolates a program’s sensitive operations in a strictly controlled environment in order to prevent attackers from writing and executing malicious code on the underlying system even after exploiting a traditional remote code execution vulnerability in the program’s code.

    A successful exploit against a sandboxed program would have to leverage multiple vulnerabilities, including one that allows the exploit to escape from the sandbox. Such sandbox bypass vulnerabilities are rare, because the code that implements the actual sandbox is usually carefully reviewed and is fairly small in length compared to the program’s overall codebase that could contain vulnerabilities.

    Adobe added a sandbox mechanism to isolate write operations called Protected Mode in Adobe Reader 10. The sandbox was further expanded to cover read-only operations as well in Adobe Reader 11, through a second mechanism called Protected View.

    Back in November, security researchers from Russian security firm Group-IB reported that an exploit for Adobe Reader 10 and 11 was being sold on cybercriminal forums for between $30,000 and $50,000. The exploit’s existence was not confirmed by Adobe at the time.

    “Before the introduction of the sandbox, Adobe Reader was one of the most targeted third-party applications by cybercriminals,” Bogdan Botezatu, a senior e-threat analyst at antivirus vendor BitDefender, said Wednesday via email. “If this is confirmed, the discovery of a hole in the sandbox will be of crucial importance and will definitely become massively exploited by cybercriminals.”

    Botezatu believes that bypassing the Adobe Reader sandbox is a difficult task, but he expected this to happen at some point because the large number of Adobe Reader installations makes the product an attractive target for cybercriminals. “No matter how much companies invest in testing, they still can’t ensure that their applications are bug free when deployed on production machines,” he said.

    Unfortunately Adobe Reader users don’t have many options to protect themselves if a sandbox bypassing exploit actually exists, except for being extremely careful of what files and links they open, Botezatu said. Users should update their installations as soon as a patch becomes available, he said.

Leave a Reply