Flash exploit used to steal gaming passwords

Posted by   Virus Bulletin on   May 29, 2008

Despite initial panic, threat no longer believed to a zero-day exploit.

In the past few days, thousands of websites have indirectly been serving malicious Adobe Flash (.SWF) files. It is believed that legitimate sites have been hacked via SQL injection to include a script that causes browsers to redirect to sites hosting malicious .SWF files. The Flash files reside on various domains in China and exploit a vulnerability in the Flash Player to download trojans capable of stealing passwords for the popular World of Warcraft game.

Originally, it was thought to be a zero-day exploit, causing panic among Internet users and raising questions among security researchers as to why such an opportunity was being used by malware authors for something as relatively fruitless as the stealing of gaming passwords. However, researchers at Symantec have since confirmed that the flaw has been patched in the latest version of Flash (9.0.124.0) and, consequently, they have lowered the threat level to 'Normal'.

Users are still advised to check which version of Flash they are running for every browser they use. If this turns out to be a version prior to 9.0.124.0, users are advised to upgrade immediately or, if unable to do so, to disable Flash. As many of the websites used in the attack are genuine sites that have been hacked, 'careful surfing' will not help prevent infection.

Posted on 29 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Didn't come to VB2017? Tell us why!

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of…

Montreal will host VB2018

Last week, we announced the full details of VB2018, which will take place 3-5 October 2018 at the Fairmont The Queen Elizabeth hotel in Montreal, Quebec, Canada.

VB2017 preview: Beyond lexical and PDNS (guest blog)

In a special guest blog post, VB2017 Silver sponsor Cisco Umbrella writes about a paper that researchers Dhia Mahjoub and David Rodriguez will present at the conference this Friday.

Avast to present technical details of CCleaner hack at VB2017

The recently discovered malicious CCleaner version has become one of the biggest security stories of 2017. Two researchers from Avast, the company that had recently acquired CCleaner developer Piriform, will share the results of their investigations…

VB2017 preview: Walking in your enemy's shadow: when fourth-party collection becomes attribution hell

We preview the VB2017 paper by Kaspersky Lab researchers Juan Andrés Guerrero-Saade and Costin Raiu on fourth-party collection and its implications for attack attribution.