Adobe released an advisory Tuesday afternoon regarding the recent zero day exposed in the 400GB Hacking Team data breach. They intend to release a patch today.
The vulnerability is a byte array use-after-free memory issue, which means that an attacker can gain control of a device by noticing who out there is running the current version of Flash Player, and injecting malicious code on to their machine. Basically, if you’re running Flash, it gives the attacker an opening(so maybe disable Flash until the patch comes out today).
At least three major exploit kits, Angler, Neutrino, and Nuclear have already added the flaw in to their arsenals, and the vulnerability is already being taken advantage of in the wild. These kits sell for as much as $15,000, so imagine what the estimated benefits are to an attacker.’
Currently, the Adobe Flash Player vulnerability is the only confirmed zero day exploit, but the fact that it turned out to be real says a great deal about this hack. Not only is Hacking Team full of it when they claim that “Most of what the attackers are claiming is simply not true”, but it is incredibly likely that all of those vulnerabilities will have some level of truthfulness to them.
Considering Hacking Team knew about the Flash vulnerability, and neglected to disclose it, it’s pretty evident it was being given to customers. Since the vulnerability could grant complete control over a machine, the sky would be the limit. They could download all of your data, record your keystrokes, watch you through your own camera, or record you through your own microphone. Now, think about the fact that most of their customers are government agencies, including our own! Doesn’t exactly inspire trust….
For information on how you can prevent your organization from being breached, visit www.miltonsecurity.com or call 714-515-4011.