Flash exploit used to steal gaming passwords

Posted by   Virus Bulletin on   May 29, 2008

Despite initial panic, threat no longer believed to a zero-day exploit.

In the past few days, thousands of websites have indirectly been serving malicious Adobe Flash (.SWF) files. It is believed that legitimate sites have been hacked via SQL injection to include a script that causes browsers to redirect to sites hosting malicious .SWF files. The Flash files reside on various domains in China and exploit a vulnerability in the Flash Player to download trojans capable of stealing passwords for the popular World of Warcraft game.

Originally, it was thought to be a zero-day exploit, causing panic among Internet users and raising questions among security researchers as to why such an opportunity was being used by malware authors for something as relatively fruitless as the stealing of gaming passwords. However, researchers at Symantec have since confirmed that the flaw has been patched in the latest version of Flash (9.0.124.0) and, consequently, they have lowered the threat level to 'Normal'.

Users are still advised to check which version of Flash they are running for every browser they use. If this turns out to be a version prior to 9.0.124.0, users are advised to upgrade immediately or, if unable to do so, to disable Flash. As many of the websites used in the attack are genuine sites that have been hacked, 'careful surfing' will not help prevent infection.

Posted on 29 May 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Research paper shows it may be possible to distinguish malware traffic using TLS

Researchers at Cisco have published a paper describing how it may be possible to use machine learning to distinguish malware command-and-control traffic using TLS from regular enterprise traffic, and to classify malware families based on their…

Is CVE-2017-0199 the new CVE-2012-0158?

After five years of exploitation in a wide variety of attacks, CVE-2012-0158 may have found a successor in CVE-2017-0199, which is taking the Office exploit scene by storm.

Review: BSides London 2017

Virus Bulletin was a proud sponsor of BSides London 2017 - Martijn Grooten reports on a great event.

VB2017: one of the most international security conferences

It is well known that the problem of cybersecurity is a global one that affects users worldwide - but it's also one that has some unique local flavours. With speakers representing at least 24 countries, VB2017 is one of the most international…

VB2016 paper: Diving into Pinkslipbot's latest campaign

Qakbot or Qbot, is a banking trojan that makes the news every once in a while and was the subject of a VB2016 paper by Intel Security researchers Sanchit Karve, Guilherme Venere and Mark Olea. In it, they provided a detailed analysis of the…