|
|
|
New Zero-day Vulnerability Used in Operation Hangover Attacks |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : On November 5, Microsoft issued an advisory and a blog post to report a new zero-day vulnerability in the Microsoft Graphics component that affects Windows, Microsoft Office and Microsoft Lync the Multiple Microsoft Products Remote Code Execution Vulnerability CVE-2013-3906 . The advisory states that the vulnerability exists in the way that certain components handle specially crafted TIFF images, potentially allowing an attacker to remotely execute code on the affected computer. While Microsoft has yet to release a patch for this vulnerability, it has provided a temporary Fix It tool as a workaround until a security update is made available. To ensure that Symantec customers are protected from attacks targeting this zero-day vulnerability, the following protection is being released Antivirus Trojan.Hantiff Bloodhound.Exploit.525 Intrusion Prevention System Web Attack Microsoft Office RCE CVE-2013-3906_2 The Microsoft blog post states that this vulnerability is being actively exploited in targeted attacks using crafted Word documents sent in emails. Symantec s research into the exploitation of this zero-day flaw in the wild has shown that our Symantec.Cloud service preemptively blocks emails sent as part of this attack. Here are some examples of the email subject headings and the attached files names seen in the attack File name Details_Letter of Credit.docEmail subject Illegal Authorization for Funds Transfer File name Missing MT103 Confirmation.docxEmail subject Problem with Credit September 26th 2013 File name Illegality_Supply details.docxEmail subject Illegal Authorization for Funds Transfer After analyzing the payloads being used in this attack, we have identified that the targeted emails are part of an attack campaign known as Operation Hangover, which we covered back in May 2013 in the blog post Operation Hangover Q A on Attacks. At that time, the group behind these attacks was known to have targeted multiple vulnerabilities, but was not known to have focused on any zero-day flaws in the attacks. As predicted in our previous blog post, the exposure of Operation Hangover would not adversely affect the activities of the group orchestrating the campaign, which can be clearly seen now with these latest activities involving the zero-day vulnerability. Symantec has protection in place for the threats used in this latest wave of the Operation Hangover campaign as Trojan.Mdropper, Downloader and Infostealer. To allow customers to identify this attack, we are mapping the latest components of the Operation Hangover campaign to Trojan.Smackdown.B and Trojan.Hangove.B. Symantec will continue to investigate this attack to ensure that the best possible protection is in place. As always, we recommend that users keep their systems up-to-date with the latest software patches and refrain from opening any suspicious emails. We also advise customers to use the latest Symantec technologies and incorporate the latest Symantec consumer and enterprise solutions to best protect against attacks of this kind.
Les mots clés de la revue de presse pour cet article : zero-day vulnerability
Les videos sur SecuObs pour les mots clés : vulnerability
Les éléments de la revue Twitter pour les mots clé : zero-day vulnerability
Les derniers articles du site "Symantec Connect Security Response Billets" :
- What you need to know about election apps and your personal data
- Microsoft Patch Tuesday April 2016
- New Adobe Flash Player exploit used by Magnitude and Nuclear exploit kits
- Latest Intelligence for March 2016
- New Flash zero-day exploited by attackers in the wild
- Samsam may signal a new trend of targeted ransomware
- Four tax scams to watch out for this tax season
- Most prevalent Android ransomware in the West arrives in Japan
- Taiwan targeted with new cyberespionage back door Trojan
- Seven Iranians charged in relation to cyberattacks against US
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
