Adobe Exploit Overtakes Patch

February 15th, 2008 by JM Hipolito (Technical Communications)

Well I guess it’s better late than never… Or not.

Apparently, one of the three recently revealed bugs on Adobe Reader has already been actively exploited by hackers for at least three weeks before it was patched. That’s after thousands had already been affected.

Discovered by iDefense Labs researcher Greg McManus, this exploit was initially reported to Adobe in October 2007 but remained unacknowledged. SANS Internet Storm Center reported that the flaw remained unfixed, only to be patched three weeks after the first report of an exploit was found in an Italian forum.

Served up through banner ads or spammed through email, the malicious PDF file designed to exploit this vulnerability connects to a certain IP address to download possibly malicious files. This exploit, identified as CVE-2008-0655, affects the following Adobe software versions:

• Adobe Reader 8.1.1 and earlier versions
• Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier versions

This exploit is detected by Trend Micro as EXPL_PIDIEF.O.

Adobe has already released the security update that addresses the said exploit and has strongly recommended users to update their versions to avoid being affected. The patch is available at the Adobe Security Advisories page.

Software vendors should take immediate measures in fixing flaws and not give malware authors the time to take advantage. Such incidents indicate the importance of not only the effectivity of responses, but their timeliness as well.

Phishing vs. Phishing

February 15th, 2008 by Carolyn Guevarra (Technical Communications)

For the past years, phishers have used warning messages on their phishing emails to lure their victims such as “Update your account or it will be suspended.” An example of such an email may lead users to the following phishing site to supposedly “update” their account:

Recently, we’re seeing a new form of phishing emails that oppose the abovementioned messages. It actually warns its victims about the said phishing emails and fools users to click on a link, which leads users to a fraudulent site. Below is an example of the said email:

As always, malicious users will always try to come up with ways to gain profit, even if it means contradicting themselves. Users are advised not to click on links provided in email messages.