The PDF format, again in the spotlight
Apparently has found a package capable of taking advantage of exploits vulnerabilities in the reader more used to this format, Adobe Reader.
The "PDF Xploit Pack 'ability to exploit vulnerabilities and managed centrally to the victims in which it has managed to execute arbitrary code. Very similar to the Mpack or any other product created by the malware industry, but specifically for this product.
"PDF Xploit Pack" seems to be the first package of exploits that is responsible solely to exploit and manage vulnerabilities in the Adobe PDF reader. It is important to bear in mind that the failures can be used not only by opening a PDF file that arrives by mail, but also because they allow the browser to display PDF files embedded in it through a plugin. The attackers are getting (as usual) to violate the security of legitimate pages and hide certain IFRAME inside. To be visited, is charged a special handling to link exploiting the vulnerabilities.
What was not clear from the original source is if the package takes advantage of known vulnerabilities (for which they can be protected with the latest versions of the reader) or unknown at this time.
The PDF file, when opened with the reader vulnerable, download other malware that actually contains the payload. We must remember that the PDF format because it was used as a "downloader" in February this year, and the attack proved quite popular. Zonebac install the trojan.
Just over one year ago, also took advantage of a vulnerability massively shared between Adobe Reader and Windows with Internet Explorer 7. This time it was used for the verdict, through a command line embedded in PDF, FTP download and execute code automatically when you open the file. Also that year, in June, became popular in a dazzling but short-lived junk mail in PDF format, flooding mailboxes around the world and bypassing some antispam filters that were not prepared.
Read more »
