We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Unpatched PDF flaw being used by Zeus botnet

First widespread attack using Reader design flaw

The Zeus botnet is now using an unpatched flaw in Adobe's PDF document format to infect users with malicious code, security researchers said today.

The attacks come less than a week after other experts predicted that hackers would soon exploit the '/Launch' design flaw in PDF documents to install malware on unsuspecting users' computers.

The just-spotted Zeus variant uses a malicious PDF file that embeds the attack code in the document, said Dan Hubbard, CTO of Websense.

When users open the rogue PDF, they're asked to save a PDF file called 'Royal_Mail_Delivery_Notice.pdf'. That file, however, is actually a Windows executable that when it runs, hijacks the PC.

Zeus is the first major botnet to exploit a PDF's /Launch feature, which is, strictly speaking, not a security vulnerability but actually a by-design function of Adobe's specification.

Earlier this month, Belgium researcher Didier Stevens demonstrated how a multistage attack using /Launch could successfully exploit a fully-patched copy of Adobe Reader or Acrobat.

Stevens was not the first to reveal the /Launch vulnerability.

n August 2009, a module using the same flaw was added to the open-source Metasploit penetration testing kit, said HD Moore, Metasploit's creator and the chief security officer at Rapid7.

"Colin Ames of Attack Research wrote this module as part of his Black Hat USA presentation," said Moore. "Didier's work was independent of what we already had, but uses almost the same method at its core."

Today, Stevens said that the Zeus attack Trojan was actually using the Metasploit module.

"From what I can read, the new Zeus PDF actually uses a [Metasploit] Adobe PDF exploit," Stevens said on Twitter, pointing to another description of the new attack by M86 Security.

Although Reader and Acrobat display a warning when an executable inside a PDF file is launched, that's not enough to stop users from launching the bogus document, said Websense's Hubbard.

"No one is blanket-blocking PDFs at the gateway," he said.

"There's so much business value in PDFs, and they're very pervasive."

In other words, people trust PDFs, he said - much more even than some other popular document formats, such as Microsoft Word.

Websense has tracked several thousand Zeus attacks using the embedded malware and /Launch function. "The attacks are still going on," Hubbard said.

While the attack technique may be new, the behind-the-scenes malware and the gang that produces it is standard Zeus fare, Hubbard continued.

Zeus is best known for planting identity theft code on victims' PC to steal, for instance, online banking logon usernames and passwords.

"The motives aren't any different here," said Hubbard.

Last week, Mickey Boodaei, CEO of security company Trusteer, bet that the /Launch function would be quickly exploited by hackers to infect PCs with financial malware.

Stevens has not released proof-of-concept attack code, but Trusteer's engineers were easily able to duplicate his attack. Zeus' creators seem to have taken an even quicker shortcut by grabbing code from Ames' Metasploit module.

"This definitely gives them another tool in their arsenal," added Hubbard, referring to the Zeus botnet operators.

Now that Zeus has weaponized the /Launch tactic, other hackers will likely pick it up as well.

"That's not uncommon," said Hubbard, "especially if there's a Metasploit module for it."

Adobe did not immediately reply to questions about whether Zeus' use of /Launch in rigged PDFs would prompt the company to release a patch for Reader and Acrobat.

Previously, Adobe has acknowledged the bug, but has not committed to producing a patch. Instead, the company has urged users to change Reader's and Acrobat's settings to disable the vulnerable function.

Since then, Brad Arkin, Adobe's director for product security and privacy, said that one way the company could address the issue would be to update Reader and Acrobat so that the feature is disabled.

Currently, Adobe's software turns on the /Launch function by default.

Adobe has posted instructions on how to configure Reader and Acrobat to stymie the attacks that Zeus is now conducting.

See also: Zeus crimeware kit includes anti-piracy technology


IDG UK Sites

Best January sales 2015 UK tech deals LIVE: Best New Year bargains and savings on phones, tablets,...

IDG UK Sites

Chromebooks: ready for the prime time (but not for everybody)

IDG UK Sites

Best Photoshop Tutorials 2014: 10 inspiring step-by-step guides to creating amazing art,...

IDG UK Sites

Mac tips tricks & hacks: 10 things you didn't know your Mac could do