New PDF Exploit May Be First Of Many In The New Year, Experts Say

Adobe will be a chief target for hackers and cybercriminals in 2010, researchers predict

A sophisticated, two-phase attack that hides in PDF documents could be the first in a long line of exploits that target vulnerabilities in Adobe applications, researchers said this week.

In a blog posted earlier this week, Internet Storm Center researcher Bohan Zdrnja describes a new JavaScript exploit that hides in PDF files and exploits a known vulnerability.

The shellcode used for the exploit is remarkable in its small footprint and sophistication, Zdrnja reports. Just 38 bytes long, it works in two stages: The first stage seeks out targets and obfuscates the attack, then passes the baton to a second-stage shellcode that is capable of executing code on a victim's machine.

The exploit's construction makes it not only difficult for traditional antivirus tools to detect, but also masks the execution of the code so that the end user might not even know anything has happened, Zdrnja says.

"Not only was this a very interesting example of a malicious PDF document carrying a sophisticated 'warhead,' but it also showed the length attackers are willing to go to in order to make their malware as hard to detect as possible, not only for the AV vendors, but also for victims," the blog says. "If we are to judge the new year by sophistication the attackers started using, it does not look too good."

The new exploit feeds the fire of predictions that Adobe, not Microsoft, will be attackers' chief target in the new year. In its new threat predictions report, security firm McAfee projects there will be more attacks on Adobe in 2010 than on Windows.

Adobe Reader and Flash are two of the most widely deployed applications in the world, and many vulnerabilities already have been discovered and patched in these applications, McAfee observes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version that could allow a malicious user with local access to execute code with administrative privileges.
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.