Watering hole attacks using zero-day vulnerabilities are becoming more common. Last week we announced an Internet Explorer 10 zero-day being used in a watering hole attack and today, just one week later we have an Adobe Flash zero-day, Adobe Flash Player and AIR CVE-2014-0502 Remote Code Execution Vulnerability (CVE-2014-0502), also being used in a watering hole attack. This new attack has been dubbed “Operation GreedyWonk” in various media and is reported to be targeting the websites of three non-profit institutions. Symantec telemetry shows even more sites being targeted in this watering hole attack using this new zero-day.
Figure 1. Watering hole attack using Adobe Flash 0-day
Anatomy of the attack
This attack technique is known as a watering hole attack. In this case the target visits a compromised website that contains an IFrame inserted by the attackers in order to redirect the target to another website (giftserv.hopto.org). This new site loads a malicious index.php file (Trojan.Malscript) which checks whether the victim is running a 32-bit or 64-bit system. Depending on the results, a malicious index.html file (also Trojan.Malscript) and additional components are also downloaded from either the 32-bit or 64-bit folders hosted on the attacker’s server. The malicious index.html file then loads the cc.swf Adobe Flash file (Trojan.Swifi) containing the zero-day. Once exploited, a logo.gif image file is downloaded containing encrypted shellcode which downloads and executes the malicious server.exe (Backdoor.Jolob) payload.
How can I prevent and mitigate against this attack?
Symantec recommends users update their Adobe product installations to the latest versions to address this critical vulnerability. Details of how to upgrade software are available in an Adobe Security Bulletin.
Symantec customers are protected from this zero-day attack with the following detections:
Antivirus
- Trojan.Malscript
- Trojan.Maljava
- Backdoor.Jolob
- Trojan.Swifi
- Trojan Horse
- Backdoor.Korplug
- Backdoor.Darkmoon
- Downloader
- Trojan.Gen.2
- Trojan.Gen.3
- WS.Malware.2
Intrusion Prevention Signatures
As always, we also advise customers to use the latest Symantec technologies and incorporate the latest Symantec consumer and enterprise solutions to best protect against attacks of any kind.
Watering hole attacks remain popular
This latest watering hole attack demonstrates that it remains a popular technique for attackers to target individuals of interest. The use of yet another zero-day indicates the arsenal available to attackers shows no signs of depletion. Multiple websites have been identified using this Adobe Flash zero-day, all with different payloads being delivered. This may be the result of this particular zero-day being sold to a number of different attackers, or possibly that it was used by a single attacker in multiple campaigns. Symantec continues to investigate this attack to ensure that the best possible protection is in place.
Figure 2. Anatomy of a watering hole attack