Adobe Flash Zero-day vulnerability detected: Patch right now!

Another Adobe Flash Zero-day vulnerability discovered

Cyber criminals found a new trick to use Adobe Flash to launch malicious attacks. Recently, researchers discovered another zero-day^[1] flaw that has been exploited in the Middle East via Microsoft Excel document.^[2]

The malicious document has been spotted spreading via emails. However, it does not include any malicious content inside. However, when a target opens Excel file, it calls remote access server to download malicious content to exploit the flaw in Adobe Flash. This technique allows avoiding antivirus detection.

Researchers assume that this attack was held in Qatar:

Qatar because the domain name used by the attackers was 'people.dohabayt[.]com', which includes 'Doha', Qatar's capital. The domain is also similar to a legitimate Middle East recruitment website ‘bayt[.]com’.^[3]

The malicious Excel file also included content in the Arabic language. It seems that the main targets might be embassy workers, such as ambassadors, secretaries, and other diplomats. Fortunately, the flaw was patched and users are urged to install updates (CVE-2018-5002).

The sophisticated technique allows exploiting Flash vulnerability without being detected by antivirus

Malicious email attachments can be easily identified by the major security programs. However, this time attackers found a way to bypass detection because the file itself is not dangerous.

This technique allows exploiting Flash from a remote server when a user opens a compromised Excel file. Therefore, security programs cannot mark this file as dangerous because it actually does not include malicious code.

Meanwhile, this file requesta a malicious Shock Wave Flash (SWF)^[4] file which is downloaded from the remote domain. This file is used for installing and executing malicious shell code which is responsible for loading trojan. According to the researchers, this trojan is most likely to open the backdoor on the affected machine.

Moreover, communication between a targeted device and remote hacker’s server is secured with a combination of symmetric AES and asymmetric RSA encryption ciphers:

“To decrypt the data payload, the client decrypts the encrypted AES key using its randomly generated private key, then decrypts the data payload with the decrypted AES key.
The extra layer of public key cryptography, with a randomly generated key, is crucial here. By using it, one must either recover the randomly generated key or crack the RSA encryption to analyze subsequent layers of the attack.”[Source: Icebrg]

Adobe released an update to fix this critical flaw

Adobe already released an update for Adobe Flash Player for Windows, macOS, Linux and Chrome OS. The critical vulnerability was detected in 29.0.0.171 and earlier versions of the program. Hence, users are urged to update to 30.0.0.113 version immediately.

Adobe released CVE-2018-5002^[5] patch that delivers a warning then a user opens an obfuscated Excel file. The prompt warns about potential dangers that might occur after loading the remote content.

Installation of the updates is possible via update services in the program or from the official Adobe Flash Player Download Center. We want to remind that pop-ups, ads or third-party download sources are not a safe place to install updates.