Hackers Use New Flash Zero-Day Exploit to Distribute FinFisher Spyware

FinSpy—the infamous surveillance malware is back and infecting high-profile targets using a new Adobe Flash zero-day exploit delivered through Microsoft Office documents.
Security researchers from Kaspersky Labs have discovered a new zero-day remote code execution vulnerability in Adobe Flash, which was being actively exploited in the wild by a group of advanced persistent threat actors, known as BlackOasis.

The critical type confusion vulnerability, tracked as CVE-2017-11292, could lead to code execution and affects Flash Player 21.0.0.226 for major operating systems including Windows, Macintosh, Linux and Chrome OS.

Researchers say BlackOasis is the same group of attackers which were also responsible for exploiting another zero-day vulnerability (CVE-2017-8759) discovered by FireEye researchers in September 2017.

Also, the final FinSpy payload in the current attacks exploiting Flash zero-day (CVE-2017-11292) shares the same command and control (C&C) server as the payload used with CVE-2017-8759 (which is Windows .NET Framework remote code execution).

So far BlackOasis has targeted victims in various countries including Russia, Iraq, Afghanistan, Nigeria, Libya, Jordan, Tunisia, Saudi Arabia, Iran, the Netherlands, Bahrain, United Kingdom and Angola.

The newly reported Flash zero-day exploit is at least the 5th zero-day that BlackOasis group exploited since June 2015.

The zero-day exploit is delivered through Microsoft Office documents, particularly Word, attached to a spam email, and embedded within the Word file includes an ActiveX object which contains the Flash exploit.

The exploit deploys the FinSpy commercial malware as the attack's final payload.

"The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits," the Kaspersky Labs researchers say.

FinSpy is a highly secret surveillance tool that has previously been associated with Gamma Group, a British company that legally sells surveillance and espionage software to government agencies across the world.

FinSpy, also known as FinFisher, has extensive spying capabilities on an infected system, including secretly conducting live surveillance by turning ON its webcams and microphones, recording everything the victim types on the keyboard, intercepting Skype calls, and exfiltration of files.

To get into a target's system, FinSpy usually makes use of various attack vectors, including spear phishing, manual installation with physical access to the affected device, zero-day exploits, and watering hole attacks.

"The attack using the recently discovered zero-day exploit is the third time this year we have seen FinSpy distribution through exploits to zero-day vulnerabilities," said Anton Ivanov, lead malware analyst at Kaspersky Lab.

"Previously, actors deploying this malware abused critical issues in Microsoft Word and Adobe products. We believe the number of attacks relying on FinSpy software, supported by zero day exploits such as the one described here, will continue to grow."

Kaspersky Lab reported the vulnerability to Adobe, and the company has addressed the vulnerability with the release of Adobe Flash Player versions 27.0.0.159 and 27.0.0.130.

Just last month, ESET researchers discovered legitimate downloads of several popular apps like WhatsApp, Skype, VLC Player and WinRAR (reportedly compromised at the ISP level) that were also distributing FinSpy.

So, businesses and government organizations around the world are strongly recommended to install the update from Adobe as soon as possible.

Microsoft will also likely be releasing a security update to patch the Flash Player components used by its products.

Enable Google's New "Advanced Protection" If You Don't Want to Get Hacked

Google already provides various advanced features such as login alerts and two-factor authentication to keep your Google account secure.

However, if you are extra paranoid, Google has just introduced its strongest ever security feature, called "Advanced Protection," which makes it easier for users, who are usually at high risk of targeted online attacks, to lock down their Google accounts like never before.

"We took this unusual step because there is an overlooked minority of our users that are at particularly high risk of targeted online attacks," the company said in a blog post announcing the program on Tuesday. 

"For example, these might be campaign staffers preparing for an upcoming election, journalists who need to protect the confidentiality of their sources, or people in abusive relationships seeking safety."

Even if a hacker somehow gets your password—using advanced phishing attacks, zero-day exploits or spyware—and tries to access your Google account, they will not be able to get in.

To enable Google's Advanced Protection feature, you will need two physical security keys that work with FIDO Universal 2nd Factor (U2F)—which offers a hardware-based two-factor authentication that does not require secret codes via SMS or emails.

To log into your Google account from a computer or laptop will require a special USB stick while accessing from a smartphone or tablet will similarly require a Bluetooth-enabled dongle, paired with your phone.

"They [security devices] use public-key cryptography and digital signatures to prove to Google that it's really you," the post reads. "An attacker who does not have your Security Key is automatically blocked, even if they have your password."

Google's Advanced Protection offer three features to keep your account safe:

1. Physical Security Key: Signing into your account requires a U2F security key, preventing other people (even with access to your password) from logging into your account.
2. Limit data access and sharing: Enabling this feature allows only Google apps to get access to your account for now, though other trusted apps will be added over time.
3. Blocking fraudulent account access: If you lose your U2F security key, the account recovery process will involve additional steps, "including additional reviews and requests for more details about why you've lost access to your account" to prevent fraudulent account access.

Advanced Protection feature is not designed for everyone, but only for people, like journalists, government officials and activists, who are at a higher risk of being targeted by government or sophisticated hackers and ready to sacrifice some convenience for substantially increased e-mail protection.

Currently, if you want to enrol in the Advanced Protection Program, you will need Google Chrome, since only Chrome supports the U2F standard for Security Keys. However, the technology expects other browsers to incorporate this feature soon.

Google Adds ESET Malware Detection to Chrome

Google has also made a notable change by partnering with anti-virus software firm ESET to expand the scope of malware detection and protection in its browser through the Chrome Cleanup feature.

Chrome Cleanup now has a malware detection engine from ESET, which works in tandem with Chrome's sandbox technology.

"We can now detect and remove more unwanted software than ever before, meaning more people can benefit from Chrome Cleanup," Google said in a blog post published Monday. 

"Note this new sandboxed engine is not a general-purpose antivirus—it only removes software that doesn’t comply with our unwanted software policy."

You can sign-up for Google's Advanced Protection here.

9 Online Training Courses For Hacking

How to become a Professional Hacker? This is one of the most frequently asked queries we came across on a daily basis.

Do you also want to learn real-world hacking techniques but don’t know where to start? This week's THN deal is for you.

Today THN Deal Store has announced a new Super-Sized Ethical Hacking Bundle that let you get started your career in hacking and penetration testing regardless of your experience level.

The goal of this online training course is to help you master an ethical hacking and penetration testing methodology.

This 76 hours of the Super-Sized Ethical Hacking Bundle usually cost $1,080, but you can exclusively get this 9-in-1 online training course for just $43 (after 96% discount) at the THN Deals Store.

9-in-1 Online Hacking Courses: What's Included in this Package?

The Super-Sized Ethical Hacking Bundle will provide you access to the following nine online courses that would help you secure your network and become a certified pentester:

1. Bug Bounty: Web Hacking

Hackers breaching a system or network of a company could end up in jail, but legally hacking and responsibly reporting it to the respective company could help you earn a good amount.

Even Google and Facebook paid out $6 Million and $5 Million respectively last year to hackers and bug hunters for discovering and reporting vulnerabilities in their web services as part of their bug bounty programs.

This course will help you explore types of vulnerabilities such as SQL, XSS, and CSRF injection and how you can use them to legally hack major brands like Facebook, Google, and PayPal and get paid.

2. CompTIA Security + Exam Preparation

If you are a beginner and you want to try your hands and make a career in the cyber world, then you need a good certification.

Beginning with basic security fundamentals, threats and vulnerabilities, this course will help you walk through more advanced topics, providing you with the knowledge you need to pass the globally-recognized CompTIA Security+ certification exam in one go.

3. Ethical Hacking Using Kali Linux From A to Z

Kali Linux is always one of the most modern ethical hacking tools and a favourite tool of hackers and cyber security professionals.

This course offers you with the knowledge about Kali Linux – one of the popular operating systems that come with over 300 tools for penetration testing, forensics, hacking and reverse engineering – and practising different types of attacks using its hacking capabilities.

4. Ethical Hacking From Scratch to Advanced Techniques

Since every single day a company is getting hacked and having its website shut down or customers' data compromised, ethical hackers are in demand. If you want to take steps closer to a new career in ethical hacking, this course is for you.

This course will help you learn how to bypass different security layers, break into networks, compromise computers, crack passwords, crash systems, and compromise apps, emails, social media accounts, and then evaluate their security, and propose solutions.

5. Learn Social Engineering From Scratch

Social engineering has been the primary cause of most high profile cyber-attacks in recent years. The impact of it on an organisation could result in economic loss, loss of Privacy, temporary or permanent Closure, loss of goodwill and Lawsuits and Arbitration.

This course will help you learn how to hack into all major operating systems, including Windows, macOS, and Linux, use social engineering to deliver Trojans to a target, and interact with the compromised systems, as well as protect your company from such attacks.

6. Learn Website Hacking and Penetration Testing From Scratch

To protect your websites and infrastructure from getting hacked by hackers, you first need to think like a hacker.

This course will help you learn how to hack websites and applications by carrying out different cyber attacks against it as a black hat hacker but fix those holes that allowed you to hack them like a white hat.

7. Hands on, Interactive Penetration Testing & Ethical Hacking

This course will teach you, in real time, each stage of a penetration testing environment so that you can tweak and test your skills.

You will also learn how to use Rapid 7's Metasploit to exploit targets and run post exploitation techniques, utilise PowerShell with Empire, and evade anti-virus software from major vendors.

8. Complete WiFi and Network Ethical Hacking Course 2017

WiFi hacking is an all time hot topic among hackers as well as penetration testers.

This online Wi-Fi and Network Ethical Hacking course are structured in a way to provide you with an in-depth, hands-on, comprehensive information on Wi-Fi hacking and its security to protect it from any cyber attack.

By the end of this course, regardless of experience, you will be able to break all types of WiFi encryption methods and ready to start pursuing your career in network security.

9. Cyber Security Volume I: Hackers Exposed

Internet security has never been as important as it is today with more information than ever being handled digitally around the globe, government conducting mass surveillance, and hackers stealing sensitive data from the ill-equipped networks, websites, and PCs.

This course will walk you through basics of hacking to an understanding of the threat and vulnerability landscape, build a foundation to expand your security knowledge, and protect yourself and others.

Google Play Store Launches Bug Bounty Program to Protect Popular Android Apps

Google has finally launched a bug bounty program for Android apps on Google Play Store, inviting security researchers to find and report vulnerabilities in some of the most popular Android apps.

Dubbed "Google Play Security Reward," the bug bounty program offers security researchers to work directly with Android app developers to find and fix vulnerabilities in their apps, for which Google will pay $1000 in rewards.

"The goal of the program is to further improve app security which will benefit developers, Android users, and the entire Google Play ecosystem," the technology giant says in a blog post published today.

Google has collaborated with bug bounty platform, HackerOne, to manage backend for this program, like submitting reports and inviting white-hat hackers and researchers.

White-hat hackers who wish to participate can submit their findings directly to the app developers. Once the security vulnerability has been resolved, the hacker needs to submit his/her bug report to HackerOne.

Google will then pay out a reward of $1,000 based on its Vulnerability Criteria, wherein, according to the company, more criteria may be added in the future, creating more scope for rewards.

"All vulnerabilities must be reported directly to the app developer first. Only submit issues to the Play Security Rewards Program that have already been resolved by the developer." HackerOne said. 

"For now, the scope of this program is limited to RCE (remote-code-execution) vulnerabilities and corresponding POCs (Proof-of-concepts) that work on Android 4.4 devices and higher."

It is an unfortunate truth that even after so many efforts by Google, malicious apps continuously somehow managed to fool its Play Store's security mechanism and infect millions of Android users.
It's notable that Google Play Security Reward program does not include finding and reporting fake, adware or malware apps available on Google play store, so the program will not affect the increase in malicious apps on Google's app platform.

For now, a limited number of Android apps have been added to Google Play Security Reward Program, including Alibaba, Snapchat, Duolingo, Line, Dropbox, Headspace, Mail.ru and Tinder.

Unpatched Microsoft Word DDE Exploit Being Used In Widespread Malware Attacks

A newly discovered unpatched attacking method that exploits a built-in feature of Microsoft Office is currently being used in various widespread malware attack campaigns.

Last week we reported how hackers could leveraging an old Microsoft Office feature called Dynamic Data Exchange (DDE), to perform malicious code execution on the targeted device without requiring Macros enabled or memory corruption.

DDE protocol is one of the several methods that Microsoft uses to allow two running applications to share the same data.

The protocol is being used by thousands of apps, including MS Excel, MS Word, Quattro Pro, and Visual Basic for one-time data transfers and for continuous exchanges for sending updates to one another.

The DDE exploitation technique displays no "security" warnings to victims, except asking them if they want to execute the application specified in the command—although this popup alert could also be eliminated "with proper syntax modification."

Soon after the details of DDE attack technique went public, Cisco's Talos threat research group published a report about an attack campaign actively exploiting this attack technique in the wild to target several organisations with a fileless remote access trojan (RAT) called DNSMessenger.

Necurs Botnet Using DDE Attack to Spread Locky Ransomware

Now, hackers have been found using the Necurs Botnet—malware that currently controls over 6 million infected computers worldwide and sends millions of emails—to distribute Locky ransomware and TrickBot banking trojan using Word documents that leverage the newly discovered DDE attack technique, reportedSANS ISC.

Locky ransomware hackers previously relied on macros-based booby-trapped MS Office documents, but now they have updated the Nercus Botnet to deliver malware via the DDE exploit and gain an ability to take screenshots of the desktops of victims.

"What’s interesting about this new wave is that the downloader now contains new functionality to gather telemetry from victims," Symantec said in a blog post. 

"It can take screen grabs and send them back to a remote server. There’s also an error-reporting capability that will send back details of any errors that the downloader encounters when it tries to carry out its activities."

Hancitor Malware Using DDE Attack

Another separate malware spam campaign discovered by security researchers has also been found distributing Hancitor malware (also known as Chanitor and Tordal) using Microsoft Office DDE exploit.

Hancitor is a downloader that installs malicious payloads like Banking Trojans, data theft malware and Ransomware on infected machines and is usually delivered as a macro-enabled MS Office document in phishing emails.

How to Protect Yourself From Word DDE Attacks?

Since DDE is a Microsoft's legitimate feature, most antivirus solutions do not flag any warning or block MS Office documents with DDE fields, neither the tech company has any plans of issuing a patch that would remove its functionality.

So, you can protect yourself and your organisation from such attacks by disabling the "update automatic links at open" option in the MS Office programs.

To do so, Open Word → Select File → Options → Advanced and scroll down to General and then uncheck "Update Automatic links at Open."

However, the best way to protect yourself from such attacks is always to be suspicious of any uninvited document sent via an email and never click on links inside those documents unless adequately verifying the source.