Firefox zero-day under attack at Nobel Prize site

CloneRanger · Nov 8, 2010

Update

Case Nobel

Two weeks ago, the web site of the prize (nobelpeaceprize.org) was hacked with a zero-day attack against Firefox.

Today, the Contagio blog has explosive news.

A targeted attack was launched yesterday, the 7th of November. The attack used an email that was spoofed to look like it originated from oslofreedomforum.com. It didn't.

If the file invitation.pdf (md5: 29DB2FBA7975A16DBC4F3C9606432AB2) is opened, it uses an exploit to crash Adobe Reader and then drops a backdoor to the system. The backdoor calls home to phile.3322.org

To mask all that, this file is shown to the user:

http://www.f-secure.com/weblog/archives/00002061.html
Click to expand...

CVE-2010-0188 - Adobe Pdf libtiff exploits analysis
Please see some of my research on Mila's Contagio Dump blog.

Part 1. invitation.pdf
Exploit in this file successfully executed in Adobe Reader 9.2, 9.3 on Windows XP (SP2, SP3) but didn't work on Windows Vista and Windows 7.

This pdf can be easily unpacked with pdftk or pdf-parser.py. It is using CVE-2006-3459 libtiff vulnerability, let look at tiff files.

http://bugix-security.blogspot.com/2010/03/cve-2010-0188-adobe-pdf-libtiff-remote.html
Click to expand...

CVE-2010-2883 PDF An invitation to the Nobel Prize ceremony of Liu Xiaobo

http://contagiodump.blogspot.com/2010/11/cve-2010-2883-pdf-invitation-to-nobel.html
Click to expand...

hierophant · Nov 8, 2010

For me, anyway, an invitation to the Nobel Peace Prize ceremony is about as implausible as any 411 scam. I wonder who this is targeted at, and who's behind it.

Log in or Sign up

Firefox zero-day under attack at Nobel Prize site

CloneRanger Registered Member

hierophant Registered Member

Log in or Sign up

Firefox zero-day under attack at Nobel Prize site

CloneRanger Registered Member

hierophant Registered Member

Useful Searches