Exploit su una vulnerabilita' dei PDF massacreranno milioni di computer italiani?

IMPORTANTE!!

E' noto da tempo che le versioni 8 e precedenti del famoso software di adobe, acrobat reader contengano una vulnerabilta' piuttosto seria. Ovviamente questa notizia non poteva non fare gola a molti crimininali informatici ed in particolare ai nostri carissimi amici russi di RBN.

Una notizia riportata dal seguente sito è davvero molto preoccupante e ne riporto il testo integralmente:

http://www.enews20.com/news_Russian_Hacker_Team_Responsible_for_Attacks_Using_PDF_Files_03356.html

By Daniel Nicholas 00:09, October 28th 2007

A security researcher has recently reported that the ongoing attacks using malicious PDF files are caused by one of the most notorious Russian hacker groups, called the Russian Business Network of RBN. So, according to Ken Dunham, iSight Partners Inc.’s director of response, it is the Russian Business Network’s members that are behind the recent attacks that use malware-armed PDF attachments. These malicious PDF files have started to appear in the users’ email accounts’ inboxes starting this Tuesday and they have already started to succeed in infecting the Windows systems, which have been their initial targets. This type of attack is installing on the infected computer system a pair of rootkit files that “sniff and steal financial and other valuable data”, as Ken Dunham has said. The computers could easily get infected because the Russian cybercrimilas use PDF documents that seem to be quite all right. However, the corrupted PDF files are being sent through spammed emails and arrive with filenames such as YOUR_BILL.pdf, BILL.pdf, STATEMENT.pdf or INVOICE.pdf The Russian hackers have exploited the “mailto:” protocol vulnerability that has been disclosed by the U.K.-based security researcher Petko Petkov. The users have just to open the attacking PDF file, and the Trojan called Pidief.a is already launched and knocks out the Windows firewall. Pieces of malware are downloaded the computers is compromised. This is why this represents a highly dangerous type of attack and we all should be careful with the PDF spamm email.

Considerando il numero enorme di pc che contengono versioni di acrobat reader non aggiornate la situazione potrebbe diventare ben presto catastrofica.

Io stesso ho appena effettuato un controllo con secunia software inspector e sono risultato vulnerabile:





AGGIORNATE IMMEDIATAMENTE ACROBAT READER!



Su segnalazione di TNT cito questo interessantissimo articolo.

http://www.eweek.com/article2/0,1895,2209010,00.asp

Di questo scritto metto in evidenza un passaggio:

a group affiliated with the Gromozon Trojan and the LinkOptimizer Trojan attacks started to spread their own brand of malware using a variation on the PDF exploit, he said.

Using names like "report.pdf" and "debt.2007.10.31.816537.pdf", the PDF file installs several different pieces of malware, including the Zeus variant of the PRG Trojan. It uses anti-debug/anti-VMware tactics to evade analysis and slowly downloads other files to the infected host via BITS (Background Intelligent Transfer Service), a lightweight HTTP-based protocol that is usually allowed through firewalls because it's what Microsoft Update uses, Jackson said.

The new PDF malware is communicating back to servers that are not on the Russian Business Network, but instead have addresses in Malaysia, although SecureWorks is detecting data on the malware that's in Russian.

Forse siamo alla vigilia di un nuovo devastante attacco della portata simile se non superiore a quella di gromozon/linkoptimizer da parte dei soliti noti