http://www.secuobs.com L'observatoire de la securite Internet fr webmaster@secuobs.com Penetrating Intranets through Adobe Flex Applications http://www.secuobs.com/revue/news/202616.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5428 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5428 ESRT @0x58 @packet_storm - Adobe PDF LibTiff Integer Overflow http://www.secuobs.com/twitter/news/73379.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5398 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5398 ESRT @DidierStevens - New post PDF Info Stealer PoC http://www.secuobs.com/twitter/news/71528.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5340 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5340 ESRT @ChrisJohnRiley @DidierStevens - cmd.dll reverse shell in memory payload used with PDF exploit http://www.secuobs.com/twitter/news/71158.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5313 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5313 ESRT @indi303 @DidierStevens Made PoC PDF: searches My Documents budget.xls and upload it to PasteBin All in memory http://www.secuobs.com/twitter/news/70267.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5289 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5289 ESRT @xanda @carnal0wnage - Analyzing PDF exploits with Pyew http://www.secuobs.com/twitter/news/67407.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5164 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5164 ESRT @opexxx - 0day vuln in Adobe Download Manager disclosed http://www.secuobs.com/twitter/news/66957.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5146 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5146 ESRT @xanda - 3 Ways of Filling Adobe’s heap http://www.secuobs.com/twitter/news/65647.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5086 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5086 Filling Adobe's heap http://www.secuobs.com/revue/news/192149.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5063 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5063 ESRT @xanda @SophosLabs - Fake AV c/o PDF and Java exploits http://www.secuobs.com/twitter/news/64643.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5014 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5014 ESRT @mosesrenegade @daveaitel @feliam - Flash on a PDF with miniPDF.py http://www.secuobs.com/twitter/news/64646.shtml http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5013 http://www.secuobs.com/news/comments520062009-origami_pdf_virus_filtre_javascript.shtml#5013 JIT Spraying in PDF http://www.secuobs.com/revue/news/190594.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4997 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4997 PDF Header PS-Adobe-N.n PDF-M.m, library to create PDF files with an unconventional header http://www.secuobs.com/revue/news/183994.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4626 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4626 ESRT @opexxx @DidierStevens - Checked Babushka PDF with last pdf-parser.py version Works fine http://www.secuobs.com/twitter/news/56430.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4529 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4529 ESRT @feliam - Nice We had an improvement. Now detected in 3/41 AVs. Happily my obfuscation thingy is dying http://www.secuobs.com/twitter/news/56409.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4522 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4522 Generic PDF exploit hider embedPDFpy and goodbye AV detection http://www.secuobs.com/revue/news/182237.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4506 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4506 ESRT @_MDL_ @peterkruse - Neosploit PDF Obfuscation using getAnnots http://www.secuobs.com/twitter/news/55837.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4496 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4496 ESRT @danielkennedy74 - Using Group Policy to Disable JavaScript in Adobe PDF Files http://www.secuobs.com/twitter/news/55359.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4478 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4478 ESRT @craigbalding @DidierStevens - New version of PDFiD and pdf-parser http://www.secuobs.com/twitter/news/55186.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4472 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4472 ESRT @xsploitedsec @hdmoore @feliam - Undetectable JS-in-PDF exploit, Putting JS in a PDF with miniPDF.py http://www.secuobs.com/twitter/news/54869.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4457 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4457 Video : TitanGuard - protecting your PDF world http://secuobs.com/videos/news/12644.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4431 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4431 Video : ESRT @DidierStevens - Adobe Reader JavaScript Blacklist Framework http://www.secuobs.com/twitter/news/53878.shtml http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4409 http://www.secuobs.com/news/comments420062009-origami_pdf_virus_filtre_javascript.shtml#4409 ESRT @xanda - IDA Pro 5.6 PDF file loader to extract and analyse shellcode http://www.secuobs.com/twitter/news/52745.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4372 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4372 Adobe testing new automatic updater http://www.secuobs.com/revue/news/178658.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4361 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4361 Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324 http://www.secuobs.com/revue/news/177835.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4329 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4329 PDF Exploit Malware analysis http://www.secuobs.com/revue/news/174901.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4222 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4222 ESRT @InfosecurityMag - Webroot reports zero-day malware generating forged Microsoft security certificates http://www.secuobs.com/twitter/news/48114.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4166 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4166 ESRT @maxcaceres - Adobe Reader and Acrobat JavaScript Blacklist Framework Mitigation for APSA09-07 http://www.secuobs.com/twitter/news/47921.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4165 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4165 Video : ESRT @ebordac - Metasploit Adobe 0-day http://www.secuobs.com/twitter/news/47972.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4164 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4164 ESRT @JGamblin @threatpost: Adobe to Patch Zero-Day Flaw on Jan 12 http://www.secuobs.com/twitter/news/47918.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4163 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4163 Adobe warns of Reader, Acrobat attack in the wild http://www.secuobs.com/revue/news/172042.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4133 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#4133 Millions of PDF invisibly embedded with your internal disk paths http://www.secuobs.com/revue/news/163972.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#3855 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#3855 ESRT @dloss @lennyzeltser : How to analyze malicious Microsoft Office and PDF document files http://www.secuobs.com/twitter/news/40050.shtml http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#3846 http://www.secuobs.com/news/comments320062009-origami_pdf_virus_filtre_javascript.shtml#3846 ESRT @xanda @d3t0n4t0r - Yet another PDF analyzer http://www.secuobs.com/twitter/news/39063.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3788 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3788 pdfresurrect-v0_9.tar.gz http://www.secuobs.com/revue/news/161546.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3765 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3765 Origami v1.0.0-beta1b released http://www.secuobs.com/revue/news/159152.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3674 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3674 Hiding a PDF Document http://www.secuobs.com/revue/news/158922.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3667 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3667 ESRT @xanda - CVE-2009-2979 Or The XML-Bombed PDF http://www.secuobs.com/twitter/news/34383.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3584 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3584 ESRT @xme ExeFilter is another framework to analyze dynamic files PDFiD Origami could supported soon #hacklu http://www.secuobs.com/twitter/news/33727.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3560 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3560 Smashing the Adobe Heap Memory Management System for Profit http://www.secuobs.com/revue/news/151965.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3425 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3425 Xpdf Integer overflow which causes heap overflow and NULL pointer dereference http://www.secuobs.com/secumail/fdsecumail/msg26269.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3385 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3385 Adobe patches 29 critical vulnerabilities http://www.secuobs.com/revue/news/150146.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3352 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3352 Update PDFiD Version 0.0.9 to Detect Adobe CVE-2009-3459 0Day http://www.secuobs.com/revue/news/150128.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3351 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3351 New Adobe Vulnerability Exploited in Targeted Attacks http://www.secuobs.com/revue/news/148801.shtml http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3294 http://www.secuobs.com/news/comments220062009-origami_pdf_virus_filtre_javascript.shtml#3294 origami-1.0.0-beta1.tar.gz http://www.secuobs.com/revue/news/148492.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3283 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3283 PDFinjector Inject JavaScript into PDF http://www.secuobs.com/revue/news/146496.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3227 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3227 Preventing Malicious Documents from Compromising Windows Machines http://www.secuobs.com/revue/news/144864.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3181 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3181 Attackers target PDF, DirectShow flaws with malicious banner ads http://www.secuobs.com/revue/news/144079.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3149 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3149 Vidéo : Extracting PDF from HTTP stream http://www.secuobs.com/videos/news/8999.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3123 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3123 PDFResurrect v0.8 - PDF Analysis and Scrubbing Utility http://www.secuobs.com/revue/news/140878.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3025 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#3025 ESRT @komeilipour - Analysing the PDF Exploit http://www.secuobs.com/twitter/news/19886.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2939 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2939 Vidéo : ESRT @sam280 extracting, analyzing malicious PDF shellcode, IDA Pro and python http://www.secuobs.com/twitter/news/19606.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2932 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2932 PDF signing and beyond http://www.secuobs.com/revue/news/134896.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2918 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2918 Adobe Reader 8.0.0 AcroPDF.dll Denial of Service Exploit http://www.secuobs.com/revue/news/134120.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2891 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2891 Update pdf-parser Version 0.3.5 http://www.secuobs.com/revue/news/128365.shtml http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2629 http://www.secuobs.com/news/comments120062009-origami_pdf_virus_filtre_javascript.shtml#2629 ESRT @DidierStevens - New version of PDFiD posted V008 http://www.secuobs.com/twitter/news/14533.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2627 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2627 ESRT @bojanz Adobe 0-day uses Actionscript to spray the heap, Nice FireEye article http://www.secuobs.com/twitter/news/11256.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2446 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2446 ESRT @bojanz Adobe 0-day : Updated the SANS diary with some facts and new developments http://www.secuobs.com/twitter/news/11257.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2444 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2444 Vidéo : Metasploit adobe util.printf() client side exploit http://www.secuobs.com/videos/news/7186.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2440 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2440 ESRT @b10w @hdmoore live exploit for Flash bug embedded in PDF http://www.secuobs.com/twitter/news/11129.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2431 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2431 Polypack, (un)packed binaries vs AV, finding the best packer http://www.secuobs.com/revue/news/122253.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2425 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2425 origami-1.0.0-beta0.tar.gz http://www.secuobs.com/revue/news/118706.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2299 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2299 Getting the EXE out of the RTF http://www.secuobs.com/revue/news/116193.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2187 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2187 Thunder Tables to decrypt Adobe PDF and Microsoft Word documents http://www.secuobs.com/revue/news/114867.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2139 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2139 At least 4 ways to die opening a PDF http://www.secuobs.com/revue/news/114042.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2110 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2110 New JsUnpack Release http://www.secuobs.com/revue/news/113485.shtml http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2083 http://www.secuobs.com/news/comments20062009-origami_pdf_virus_filtre_javascript.shtml#2083