25 Jan The smart screensaver Sergey Golovanov
28 Jul Zbot and CVE2010-0188 Vyacheslav Zakorzhevsky
05 Jul The figures behind the headache Aleks
09 Jan The first Microsoft patches of 2007 David
Join our blog
You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.
Install our screensaver and discover the full potential of Kaspersky Security Network! Download at: http://irida.kasperskyclub.com/scr.zip
I just came across a suspicious PDF file, so I decided to take a deeper look. Once the file was unpacked, I got an xml file with TIFF image. However, the whole thing looked very strange. The whole thing looked very fishy, and ultimately, it turned out that the xml file contained an exploit for CVE-2010-0188.
I thought it was a bit odd that we hadn’t come across files like this before, so I decided to tak a look at stats for this vulnerability:
CVE-2010-0188 exploit statistics 2010
The graph shows that malware exploiting CVE=2010-0188 started spreading actively at the end of June. It was pretty much a rarity until then. Maybe the virus writers needed a few months to catch up with creating exploits for the new hole in Adobe – who knows?
When I took a closer look, it turned out that the PDF was mainly designed to download and launch another file, Trojan-Dropper.Win32.Zbot.cm. Which, in its turn, is mainly designed to secretly install Zbot (ZeuS) to the system and to combat antivirus software.
I was able to get a final example of Zbot, but it turned out to be encrypted and obfuscated. I then got its dump and decrypted strings, which included a clear link to the banking site under attack, the bot’s http requests and some of the commands used by the botnet C&C:
Part of the decrypted Zbot file
This is the first example of an encrypted Zbot variant spreading via CVE-2010-0188. Clearly, the guys behind this program aren’t sitting on their hands, but working on the most up-to-date methods of delivering their malware to end users.
The vulnerability in the Windows Help and Support Center (CVE-2010-1885) has been a constant irritation to antivirus experts for the third week in succession. I will try to provide an analysis of the problem with the help of KSN.
We first detected samples of the exploit on 10 June and at the time of writing, over 14,000 attacks using CVE-2010-1885 have been registered.
The graph above shows the number of detections per day.
However, the most important feature is the figure indicating the exploit’s distribution on the Internet. According to KSN, on 2 July, 2010 the total number of websites hosting the exploit averaged 300.
Later today Microsoft will release its latest security patches. These will include a Critical update for Windows and three others for Office (the highest of which will also be Critical). You can find the notifications in the usual place.
The use of unpatched vulnerabilies continues to be a significant part of the cyber threat landscape and, unsurprisingly, has kept Microsoft busy during 2006, as the table below shows.
We hope that the release of Windows Vista will mean less patches, but since current systems will be with us for some time to come, we'll need to remain on our guard to stay secure.