Fighting malware and spam

Flash exploit used to steal gaming passwords

Despite initial panic, threat no longer believed to a zero-day exploit.

In the past few days, thousands of websites have indirectly been serving malicious Adobe Flash (.SWF) files. It is believed that legitimate sites have been hacked via SQL injection to include a script that causes browsers to redirect to sites hosting malicious .SWF files. The Flash files reside on various domains in China and exploit a vulnerability in the Flash Player to download trojans capable of stealing passwords for the popular World of Warcraft game.

Originally, it was thought to be a zero-day exploit, causing panic among Internet users and raising questions among security researchers as to why such an opportunity was being used by malware authors for something as relatively fruitless as the stealing of gaming passwords. However, researchers at Symantec have since confirmed that the flaw has been patched in the latest version of Flash (9.0.124.0) and, consequently, they have lowered the threat level to 'Normal'.

Users are still advised to check which version of Flash they are running for every browser they use. If this turns out to be a version prior to 9.0.124.0, users are advised to upgrade immediately or, if unable to do so, to disable Flash. As many of the websites used in the attack are genuine sites that have been hacked, 'careful surfing' will not help prevent infection.

29 May 2008

Tags: flash, sql injection, trojan.   

0 comments

Comments are closed.