Zero-day exploit (CVE-2018-8453) used in targeted attacks

guest · Oct 10, 2018

Zero-day exploit (CVE-2018-8453) used in targeted attacks
October 10, 2018
https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/

Yesterday, Microsoft published their security bulletin, which patches CVE-2018-8453, among others. It is a vulnerability in win32k.sys discovered by Kaspersky Lab in August. We reported this vulnerability to Microsoft on August 17, 2018. Microsoft confirmed the vulnerability and designated it CVE-2018-8453.

The code of the exploit is of high quality and written with the aim of reliably exploiting as many different MS Windows builds as possible, including MS Windows 10 RS4.

During our investigation, we discovered the attackers were using a PowerShell backdoor that has previously been seen exclusively used by the FruityArmor APT. [...] That makes us assess with medium confidence that FruityArmor is responsible for the attacks leveraging CVE-2018-8453.
Conclusion
Even when deploying 0-days seems to be more frequent than it used to be, this would be the second time we have spotted FruityArmor using one of them to distribute its malware.
Click to expand...

itman · Oct 10, 2018

I assume the following means this bugger can bypass Win 10 RS4 core integrity protection:

The code of the exploit is of high quality and written with the aim of reliably exploiting as many different MS Windows builds as possible, including MS Windows 10 RS4.

For the latest supported version (Windows 10 RS4), the spray tactic is quite complicated. The kernel is sprayed with bitmap objects of different size. This is required to exhaust the memory allocator to eventually bypass the Low Fragmentation Heap security mitigations that were significantly improved in the latest Windows builds:
Click to expand...

Rasheed187 · Oct 13, 2018

I guess the good news is that Kaspersky's behavior blocker was able to spot this behavior. Too bad they didn't give more info on how this was done.

Log in or Sign up

Zero-day exploit (CVE-2018-8453) used in targeted attacks

guest Guest

itman Registered Member

Rasheed187 Registered Member

Log in or Sign up

Zero-day exploit (CVE-2018-8453) used in targeted attacks

guest Guest

itman Registered Member

Rasheed187 Registered Member

Useful Searches