11.8 C
London
Sunday, September 24, 2017
Home Tags FONT

Tag: FONT

In the field of information security, sandboxes are used to isolate an insecure external environment from a secure internal environment (or vice versa), to protect against the exploitation of vulnerabilities, and to analyze malicious code.

At Kaspersky Lab, we have several sandboxes, we will look at just one of them that was customized to serve the needs of a specific product and became the basis of Kaspersky Anti Targeted Attack Platform.
In the several years that the Dridex family has existed, there have been numerous unsuccessful attempts to block the botnetrsquo;s activity.

The ongoing evolution of the malware demonstrates that the cybercriminals are not about to bid farewell to their brainchild, which is providing them with a steady revenue stream.
Over 98 percent of the passwords were cracked, thanks to the site's poor password security.
One of my tasks at my job is to develop and maintain technical presentations. In the past I’ve stored these presentations on Google Drive in Apple’s Keynote format. Keynote, like many office suite applications, stores its files as big, fat binary blobs. When multiple people modify a presentation and attempt to update it, you get problems. People silently clobber each other’s changes.This annoyance isn’t unique to Keynote. PowerPoint and other formats suffer the same problem. While PowerPoint theoretically has an XML-based file, it’s wrapped in a Zip, so there’s no practical way to merge changes at the file level.[ Docker, Amazon, TensorFlow, Windows 10, and more: See InfoWorld's 2017 Technology of the Year Award winners. | Cut to the key news in technology trends and IT breakthroughs with the InfoWorld Daily newsletter, our summary of the top tech happenings. ]Another problem with Keynote is that while there are slide masters, the stuff that gets pasted into a slide has to be carefully formatted. WYSIWIG is great and awful at the same time. Stuff that gets pasted into a slide has to be formatted with love. This usually means that while the master is consistent, the contents often diverge in format: spacing is a little off, font choices go off-brand, and colors go wild.To read this article in full or to leave a comment, please click here
Microsoft security boffins throw fresh CVEs at unpatched OS, emerge smiling Microsoft says its Windows 10 Anniversary Update squashes more exploit delivery chains than ever. The August updates brought in a series of operating system security improvements including boosts to Windows Defender and use of AppContainer, designed to raise the difficulty of having zero day exploits execute on patched systems. Redmond's security team tested its exploit mitigations against two kernel-level then zero-day exploits (CVE-2016-7255, CVE-2016-7256) used by active hacking groups that offer privilege escalation. They find, in a technical analysis designed to stress test the resilience of Windows 10, that the bugs were neutered on Anniversary Update machines even before it issued the respective November patch thanks to the exploit mitigation controls. "Because it takes time to hunt for vulnerabilities and it is virtually impossible to find all of them, such security enhancements can be critical in preventing attacks based on zero-day exploits," the team says. "While fixing a single-point vulnerability helps neutralize a specific bug, Microsoft security teams continue to look into opportunities to introduce more and more mitigation techniques. "Such mitigation techniques can break exploit methods, providing a medium-term tactical benefit, or close entire classes of vulnerabilities for long-term strategic impact." The team points to the benefits of easy and complex mitigations including simple changes against RW primitives that trigger harmless blue screens of death errors. Pushing font-parsing code to isolated containers under improvements to AppContainer and additional validation for font file parsing significantly reduced the ability to use font bugs for privilege escalation, the team says. That shut the door on one South Korean hacking group which used CVE-2016-7256 in small but targeted attacks in the nation. "Windows 10 Anniversary Update introduced many other mitigation techniques in core Windows components and the Microsoft Edge browser, helping protect customers from entire classes of exploits for very recent and even undisclosed vulnerabilities," the team says. The updates follow Microsoft's decision to delay the axing of the lauded enhanced mitigation toolkit to 31 July next year. That move sparked the ire of Carnegie Mellon University CERT boffin Will Dormann who says the toolkit significantly improved the exploit mitigation chops of Windows 10 and should be maintained, not dropped. ® Sponsored: Customer Identity and Access Management
Apple is out with what is likely its' final security patch update of 2016, debuting the new macOS 10.2.2 operating system for desktops and the IOS 10.2 release for mobile devices. Apple is updating both its desktop macOS Sierra and mobile IOS operating...
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.Use this table to learn about the likelihood of code execution and denial of service exploits within 30 days of security bulletin release, for each of the security updates that you may need to install. Review each of the assessments below, in accordance with your specific configuration, to prioritize your deployment of this month's updates. For more information about what these ratings mean, and how they are determined, please see Microsoft Exploitability Index.In the columns below, "Latest Software Release" refers to the subject software, and "Older Software Releases" refers to all older, supported releases of the subject software, as listed in the "Affected Software" and "Non-Affected Software" tables in the bulletin. Bulletin ID Vulnerability Title CVE ID Exploitability Assessment forLatest Software Release Exploitability Assessment forOlder Software Release Denial of ServiceExploitability Assessment MS15-094 Information Disclosure Vulnerability CVE-2015-2483 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable MS15-094 Tampering Vulnerability CVE-2015-2484 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2485 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2486 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2487 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Elevation of Privilege Vulnerability CVE-2015-2489 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2490 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2491 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2492 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Scripting Engine Memory Corruption Vulnerability CVE-2015-2493 4 - Not Affected 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2494 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Information Disclosure Vulnerability CVE-2015-2496 0 - Exploitation Detected 0 - Exploitation Detected Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2498 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2499 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2500 4 - Not Affected 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2501 4 - Not Affected 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2541 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-094 Memory Corruption Vulnerability CVE-2015-2542 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-095 Memory Corruption Vulnerability CVE-2015-2485 1 - Exploitation More Likely 4 - Not Affected Not Applicable MS15-095 Memory Corruption Vulnerability CVE-2015-2486 1 - Exploitation More Likely 4 - Not Affected Not Applicable MS15-095 Memory Corruption Vulnerability CVE-2015-2494 1 - Exploitation More Likely 4 - Not Affected Not Applicable MS15-095 Memory Corruption Vulnerability CVE-2015-2542 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-096 Active Directory Denial of Service Vulnerability CVE-2015-2535 4 - Not Affected 3 - Exploitation Unlikely Permanent MS15-097 OpenType Font Parsing Vulnerability CVE-2015-2506 1 - Exploitation More Likely 1 - Exploitation More Likely Permanent MS15-097 Font Driver Elevation of Privilege Vulnerability CVE-2015-2507 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-097 Font Driver Elevation of Privilege Vulnerability CVE-2015-2508 2 - Exploitation Less Likely 4 - Not Affected Temporary MS15-097 Graphics Component Buffer Overflow Vulnerability CVE-2015-2510 2 - Exploitation Less Likely 1 - Exploitation More Likely Not Applicable MS15-097 Win32k Memory Corruption Elevation of Privilege Vulnerability CVE-2015-2511 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-097 Font Driver Elevation of Privilege Vulnerability CVE-2015-2512 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-097 Win32k Memory Corruption Elevation of Privilege Vulnerability CVE-2015-2517 1 - Exploitation More Likely 1 - Exploitation More Likely Permanent MS15-097 Win32k Memory Corruption Elevation of Privilege Vulnerability CVE-2015-2518 1 - Exploitation More Likely 1 - Exploitation More Likely Permanent MS15-097 Win32k Elevation of Privilege Vulnerability CVE-2015-2527 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-097 Kernel ASLR Bypass Vulnerability CVE-2015-2529 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable MS15-097 Win32k Memory Corruption Elevation of Privilege Vulnerability CVE-2015-2546 1 - Exploitation More Likely 0 - Exploitation Detected Not Applicable MS15-098 Windows Journal RCE Vulnerability CVE-2015-2513 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-098 Windows Journal DoS Vulnerability CVE-2015-2514 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-098 Windows Journal DoS Vulnerability CVE-2015-2516 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-098 Windows Journal Integer Overflow RCE Vulnerability CVE-2015-2519 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-098 Windows Journal RCE Vulnerability CVE-2015-2530 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-099 Microsoft Office Memory Corruption Vulnerability CVE-2015-2520 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-099 Microsoft Office Memory Corruption Vulnerability CVE-2015-2521 4 - Not Affected 1 - Exploitation More Likely Not Applicable MS15-099 Microsoft SharePoint XSS Spoofing Vulnerability CVE-2015-2522 3 - Exploitation Unlikely 4 - Not Affected Not Applicable MS15-099 Microsoft Office Memory Corruption Vulnerability CVE-2015-2523 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-099 Microsoft Office Malformed EPS File Vulnerability CVE-2015-2545 1 - Exploitation More Likely 0 - Exploitation Detected Not Applicable MS15-100 Windows Media Center RCE Vulnerability CVE-2015-2509 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable MS15-101 .NET Elevation of Privilege Vulnerability CVE-2015-2504 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable MS15-101 MVC Denial of Service Vulnerability CVE-2015-2526 2 - Exploitation Less Likely 2 - Exploitation Less Likely Temporary MS15-102 Windows Task Management Elevation of Privilege Vulnerability CVE-2015-2524 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-102 Windows Task File Deletion Elevation of Privilege Vulnerability CVE-2015-2525 4 - Not Affected 1 - Exploitation More Likely Not Applicable MS15-102 Windows Task Management Elevation of Privilege Vulnerability CVE-2015-2528 1 - Exploitation More Likely 1 - Exploitation More Likely Not Applicable MS15-103 Exchange Information Disclosure Vulnerability CVE-2015-2505 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-103 Exchange Spoofing Vulnerability CVE-2015-2543 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-103 Exchange Spoofing Vulnerability CVE-2015-2544 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-104 Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability CVE-2015-2531 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-104 Lync Server XSS Information Disclosure Vulnerability CVE-2015-2532 4 - Not Affected 3 - Exploitation Unlikely Not Applicable MS15-104 Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability CVE-2015-2536 3 - Exploitation Unlikely 3 - Exploitation Unlikely Not Applicable MS15-105 Hyper-V Security Feature Bypass Vulnerability CVE-2015-2534 2 - Exploitation Less Likely 2 - Exploitation Less Likely Not Applicable
Plus: 'Dirty COW' remains unfixed in Google OS Today is the second Tuesday of the month, and that means a fresh round of security updates from the likes of Microsoft, Adobe and Google. The November edition of Patch Tuesday brings with it fixes for Windows, Flash Player, Internet Explorer, Edge, Office and Android. For Microsoft, the monthly update comprises a total of 14 bulletins: MS16-129 is a cumulative update for the Edge browser addressing 17 CVE-listed flaws, including 12 that could be exploited to perform remote code execution attacks. MS16-130 is an update for three CVE-listed flaws in Windows that could allow a locally installed application to achieve remote code execution. MS16-131 patches a flaw in Microsoft Video Control for Windows that allows remote code execution by way of a media file embedded in a webpage or email message. MS16-132 addresses four CVE-listed vulnerabilities in the Microsoft Graphics Component for Windows, including yet another flaw that allows remote code execution by way of a malformed font file. MS16-133 is this month's Office update, addressing a total of 12 CVE-listed vulnerabilities allowing for remote code execution, information disclosure, and denial of service attacks by way of specially crafted files.

The bulletin also includes patches for Office for Mac, so macOS and OS X users are advised to update their software. MS16-134 is a patch for 10 elevation of privilege vulnerabilities in the Windows Common Log File System Driver.

The vulnerabilities could allow a locally installed application to take complete control over the host machine, if exploited. MS16-135 patches five elevation of privilege vulnerabilities in the Windows Kernel Mode Driver that potentially allow malicious applications to perform privilege escalation or information disclosure attacks. MS16-136 is an update for SQL Server that would allow an attacker to elevate their account privileges to view and delete data on the target system or create new accounts. MS16-137 patches three CVE-listed flaws related to the way Windows handles authentication.
It includes fixes for an elevation of privilege bug, an information disclosure vulnerability, and a denial of service flaw. MS16-138 is an update for the Microsoft Virtual Hard Disk Driver in Windows and Windows Server.
It addresses four elevation of privilege flaws that, if exploited, would allow an attacker to remotely access other restricted files on a targeted hard drive. MS16-139 is a fix for a single elevation of privilege flaw in the Windows kernel. MS16-140 addresses a flaw in the Windows Boot Manager that could allow an attacker with physical access to the system the ability to bypass code integrity checks and run test-signed applications and drivers on the target machine. MS16-141 is Microsoft's release of the November security update for Adobe Flash Player, patching all ten remote code execution vulnerabilities. MS16-142 is the cumulative update for Internet Explorer, addressing seven CVE-listed flaws allowing for remote code execution and information disclosure by way of a malformed webpage. But wait, there's more... Adobe and Google Not to be outdone, Adobe has posted fixes for nine CVE-listed flaws in Flash Player for Windows, macOS and Linux.

The vulnerabilities could be used by an attacker for remote code execution by way of malformed Flash media files. For those running Google Chrome, Microsoft Edge, and Internet Explorer version 11 and later, the Flash patches will be automatically downloaded and installed. Users and administrators managing other browsers are advised to patch Flash Player as soon as possible, though killing it is also an option. Adobe has also released an update to address a flaw in its Connect conferencing application.

That bug, only present on Windows, could allow an attacker to perform a cross-site scripting attack.

Connect for Windows users should update to version 9.5.7. Google, meanwhile, has released a security update for 82 CVE-listed vulnerabilities in Android.

The Google update, designated 2016-11-05, will be released for all Google devices and is recommended for other Android devices as the "complete" security patch level (vendors also have the option of pushing out a partial patch with only the most serious bug fixes). Among the flaws addressed in the November Android update are elevation of privilege vulnerabilities in the Nvidia GPU driver firmware, a remote code execution vulnerability in the Qualcomm crypto driver, and denial of service bugs in Bluetooth, OpenJDK and Media Server. Not fixed was CVE-2016-5195, popularly known as "Dirty COW." That bug, allowing installed applications to swipe "root" privilege and hijack the device, is slated to be patched in next month's scheduled update. ®
Microsoft followed through and today patched a zero-day vulnerability being exploited in public attacks that was disclosed by Google researchers nine days ago. The victims have yet to have been identified, but Microsoft did accuse the Sofacy APT gang of carrying out the attacks.
Sofacy is generally thought to have ties to Russian military intelligence and its targets are strategic, such as government and diplomatic agencies, military and defense contractors, and public policy think-tanks. Google’s disclosure on Oct. 31 came 10 days after it privately reported the vulnerability to Microsoft, along with a Flash zero day to Adobe also used in these attacks. Adobe patched the Flash vulnerability with an emergency update released on Oct. 26, but Microsoft failed to publicly acknowledge the bug until only after Google publicly disclosed it.

Google’s internal policy gives vendors seven days to publicly report or patch vulnerabilities being actively exploited. Google said the vulnerability is a local privilege escalation in the Windows kernel that leads to a sandbox escape. “It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD,” Google’s Neel Mehta and Billy Leonard said in their disclosure. The attackers chained this bug and the Flash zero day in order to get on targeted computers.

The sandbox escape allows the attacker to run code in kernel mode. “Microsoft implemented new exploit mitigations in the Windows 10 Anniversary Update version of the win32k kernel component,” Microsoft said in its bulletin, MS16-135. “These Windows 10 Anniversary Update mitigations, which were developed based on proactive internal research, stop all observed in-the-wild instances of this exploit.” MS16-135 also patched two other elevation of privilege vulnerabilities in the Windows kernel (CVE-2016-7215 and CVE-2016-7246), as well as an information disclosure bug in the kernel that opens the door for a kernel ASLR bypass (CVE-2016-7214), and a separate information disclosure bug in the Windows browser.sys kernel-mode driver (CVE-2016-7218). Six of the 14 bulletins put out by Microsoft today are rated critical. One, MS16-132, included another vulnerability under attack in the Windows Graphics Component. Microsoft said a remote code execution Open Type Font vulnerability was patched in the Windows font library. That bulletin patched three other flaws, including an information disclosure flaw in Open Type Font, specifically in the ATMFD component, which leaks enough information to carry out a further compromise.

Also addressed was a remote code execution memory corruption vulnerabilities in Windows Animation Manager and Windows Media Foundation. Microsoft also provided cumulative updates for its browsers, Edge and Internet Explorer.

The Edge update, MS16-129, patched 17 vulnerabilities, most of which lead to remote code execution.

Two of the flaws, CVE-2016-7209 and CVE-2016-7199, were publicly disclosed, Microsoft said, but not used in in-the-wild attacks.

The second disclosed bug was also patched in the Internet Explorer update, MS16-142, which patched seven CVEs. MS16-130 patched three critical Windows bugs, a remote code execution flaw in the way Windows’ image file loading handles malformed image files, along with two elevation of privilege flaws in Windows IME and Windows Task Scheduler. Another remote code execution vulnerability was addressed in MS16-131 in the Microsoft Video Control component.

The remaining critical bulletin is the Adobe Flash Player update for IE and Edge; Adobe released an update today for Flash Player patching nine remote code execution flaws in the software. Though rated important by Microsoft, an Office bulletin, MS16-133, also merits attention because it patches a dozen vulnerabilities including 10 that lead to remote code execution. None of the Office bugs are being publicly attacked, Microsoft said. Microsoft also patched SQL Server, addressing a half-dozen elevation of privilege and information disclosure vulnerabilities in MS16-136.

Three of the EoP bugs are in the SQL Server RDBMS engine, along with a cross-site scripting flaw in SQL Server MDS, an information disclosure issue in SQL Analysis Services, and another EoP issue in the SQL Server Engine Server Agent. “The top priority for most administrators will be to quickly deploy fixes for browsers, graphics components, and Office.

All of these components are affected by one or more code execution vulnerabilities Microsoft has classified as highly exploitable,” said Craig Young, security researcher at Tripwire. “These are of the highest priority due to the fact that the vulnerabilities can potentially be triggered through normal web browsing activities giving an external attacker a way into networks.” The remaining bulletins are also rated important: MS16-134 patches 10 elevation of privilege flaws in the Windows Common Log File System (CLFS) MS16-137 patches three vulnerabilities in Windows NTLM, Virtual Secure Mode and Local Security Authority Subsystem Service MS16-138 patches four elevation of privilege vulnerabilities in the Windows Virtual Hard Disk Driver MS16-139 patches a local Windows kernel elevation of privilege flaw in how the Windows Kernel API enforces permissions MS16-140 patches a security feature bypass in the Windows Secure Boot component; an attacker could disable code integrity checks and allow test-signed executables and drivers to be loaded.
Get patching now Apple has distributed a fresh round of security updates to address remote-code execution holes in iOS, macOS, Safari, and the firmware for Apple Watch and AppleTV. Miscreants who exploit these flaws can take over the vulnerable device – all a victim has to do is open a JPEG or PDF file booby-trapped with malicious code, so get patching before you're caught out.

Check for software The fixes come just days before the Cupertino developer of TextEdit is set to hold a special event to introduce a (presumed) refresh of its Mac product line and potentially new iPad tablets. For those running iOS, the 10.1 release includes updates to address 12 CVE-listed security vulnerabilities in the firmware for the iPhone, iPad and iPod Touch. Those flaws include a remote code execution flaw in the handling of JPEG images (CVE-2016-4673), a remote code execution bug in WebKit (CVE-2016-4677), local code execution flaws, and a vulnerability in contacts (CVE-2016-4686) that would let an application pull Address Book details even when access has been revoked. For macOS Sierra (10.12.1), the update brings fixes for 16 CVE-listed vulnerabilities.

Those include the CVE-2016-4673 image-handling bug as well as remote code execution flaws that could be triggered by font files (CVE-2016-4667) and PDF files (CVE-2016-4671).

Also released was a fix for a denial of service error in Nvidia graphics card drivers (CVE-2016-4663) and a bug that exposed the length of user passwords (CVE-2016-4670). Included among the latest fixes for iOS and macOS was CVE-2016-4635, a remote audio eavesdropping vulnerability for FaceTime that Apple had previously attempted to remedy in older versions of iOS and OS X. Apple did not say whether the flaw was exposed in iOS 10.1 and macOS Sierra, or if the fix was an update to an already-installed security measure. For those running the Safari browser on Sierra and older versions of OS X, Apple has produced patches to address a trio of WebKit flaws that can allow web pages or applications to achieve remote code execution (CVE-2016-4666, CVE-2016-4677) and pull location information (CVE-2016-4676). Meanwhile, Apple Watch users are advised to update their arm candy to watchOS 3.1 to get fixes for eight CVE-listed flaws, including two flaws in sandbox profiles (CVE-2016-4664, CVE-2016-4665) that allow third-party applications to view image libraries and sound files without permission. The AppleTV will also get an update for 10 flaws, including the sandbox profiles flaws (CVE-2016-4664, CVE-2016-4665), the WebKit remote code execution bug (CVE-2016-4677), and the CoreGraphics JPEG bug (CVE-2016-4673) patched in other Apple products. ®
A critical vulnerability in the Windows GDI (graphics device interface) that Microsoft patched in its latest round of security updates was exploited by a sophisticated attack group to escape browser-based sandboxes and remotely execute malicious code, ...
Get your patching done, people, this Font-borne bug is being actively exploited Kaspersky Labs researcher Anton Ivanov says an advanced threat group was exploiting a Windows zero day vulnerability before Microsoft patched it last week. Microsoft says the graphics device interface vulnerability (CVE-2016-3393) allowed attackers to gain remote code execution and elevation of privilege powers. Ivanov's analysis reveals a hacking group dubbed FruityArmor was exploiting the vulnerability in chained attacks, using a True Type Font to trigger the bug. Here's some of his explanation: "In the case of FruityArmor, the initial browser exploitation is always followed by an EoP exploit.

This comes in the form of a module, which runs directly in memory.

The main goal of this module is to unpack a specially crafted TTF font containing the CVE-2016-3393 exploit. After unpacking, the module directly loads the code exploit from memory with the help of AddFontMemResourceEx.

After successfully leveraging CVE-2016-3393, a second stage payload is executed with higher privileges to execute PowerShell with a meterpreter-style script that connects to the command and control server." The attack saw browser sandboxes broken and higher privileges attained before a second payload executed with the newly-acquired higher access privileges. Windows 10's efforts to push font processing into a special user mode that restricts privileges did not stop the exploit. "This is a very good solution but the code has the same bug in the TTF processing," Ivanov says. The researcher says the group is unusual in its use of Powershell for its entire attack platform including the main malicious implant. He did not reveal complete details of the attack to safeguard as-yet unpatched users. ®