Adobe confirms zero-day exploit bypasses Adobe Reader sandbox

The attacks are highly sophisticated and likely part of an important cyberespionage operation, a Kaspersky Lab researcher says

A recently found exploit that bypasses the sandbox anti-exploitation protection in Adobe Reader 10 and 11 is highly sophisticated and is probably part of an important cyberespionage operation, the head of the malware analysis team at antivirus vendor Kaspersky Lab said.

The exploit was discovered Tuesday by researchers from security firm FireEye, who said that it was being used in active attacks. Adobe confirmed that the exploit works against the latest versions of Adobe Reader and Acrobat, including 10 and 11, which have a sandbox protection mechanism.

"Adobe is aware of reports that these vulnerabilities are being exploited in the wild in targeted attacks designed to trick Windows users into clicking on a malicious PDF file delivered in an email message," the company said in a security advisory published Wednesday.

Adobe is working on a patch, but in the meantime users of Adobe Reader 11 are advised to enable the Protected View mode by choosing the "Files from potentially unsafe locations" option under the Edit > Preferences > Security (Enhanced) menu.

The exploit and the malware it installs are super high-level, according to Costin Raiu, director of Kaspersky Lab's malware research and analysis team. "It's not something you see every day," he said Thursday.

Judging by the sophistication of the attacks, Raiu concluded that they must be part of an operation of "huge importance" that "would be on the same level with Duqu."

Duqu is a piece of cyberespionage malware discovered in October 2011 that's related to Stuxnet, the highly sophisticated computer worm credited with damaging uranium enrichment centrifuges at Iran's nuclear plant in Natanz. Both Duqu and Stuxnet are believed to have been created by a nation state.

The latest exploit comes in the form of a PDF document and attacks two separate vulnerabilities in Adobe Reader. One is used to gain arbitrary code execution privileges and one is used to escape from the Adobe Reader 10 and 11 sandbox, Raiu said.

The exploit works on Windows 7, including the 64-bit version of the operating system, and it bypasses the Windows ASLR (address space layout randomization) and DEP (Data Execution Prevention) anti-exploitation mechanisms.

When executed, the exploit opens a decoy PDF document that contains a travel visa application form, Raiu said. The name of this document is "Visaform Turkey.pdf."

The exploit also drops and executes a malware downloader component that connects to a remote server and downloads two additional components. These two components steal passwords and information about the system configuration, and can log keystrokes, he said.

The communication between the malware and the command-and-control server is compressed with zlib and then encrypted with AES (Advanced Encryption Standard) using RSA public-key cryptography.

This type of protection is very rarely seen in malware, Raiu said. "Something similar was used in the Flame cyberespionage malware, but on the server side."

This is either a cyberespionage tool created by a nation state or one of the so-called lawful interception tools sold by private contractors to law enforcement and intelligence agencies for large sums of money, he said.

Kaspersky Lab doesn't yet have information about this attack's targets or their distribution around the world, Raiu said.

Reached via email on Wednesday, FireEye's senior director of security research, Zheng Bu, declined to comment on the attack's targets. FireEye published a blog post with technical information about the malware on Wednesday, but didn't reveal any information about victims.

Bu said that the malware uses certain techniques to detect if it's being executed in a virtual machine so it can evade detection by automated malware analysis systems.

Join the CSO newsletter!

Error: Please check your email address.

Tags online safetysecurityadobeFireEyeDesktop securityExploits / vulnerabilitiesspywaremalwarekaspersky labintrusion

More about Adobe SystemsAdvanced Encryption StandardAES EnvironmentalFireEyeKasperskyKasperskyRSA

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place