Zeus botnet exploits unpatched PDF flaw

Researchers spot first widespread attack using Reader, Acrobat design flaw

The Zeus botnet is now using an unpatched flaw in Adobe's PDF document format to infect users with malicious code, security researchers said today.

The attacks come less than a week after other experts predicted that hackers would soon exploit the "/Launch" design flaw in PDF documents to install malware on unsuspecting users' computers.

The just-spotted Zeus variant uses a malicious PDF file that embeds the attack code in the document, said Dan Hubbard, CTO of San Diego, Calif.-based security company Websense. When users open the rogue PDF, they're asked to save a PDF file called "Royal_Mail_Delivery_Notice.pdf." That file, however, is actually a Windows executable that when it runs, hijacks the PC.

Zeus is the first major botnet to exploit a PDF's /Launch feature, which is, strictly speaking, not a security vulnerability but actually a by-design function of Adobe's specification. Earlier this month, Belgium researcher Didier Stevens demonstrated how a multistage attack using /Launch could successfully exploit a fully-patched copy of Adobe Reader or Acrobat.

Stevens was not the first to reveal the /Launch vulnerability. In August 2009, a module using the same flaw was added to the open-source Metasploit penetration testing kit, said HD Moore, Metasploit's creator and the chief security officer at Rapid7. "Colin Ames of Attack Research wrote this module as part of his Black Hat USA presentation," said Moore. "Didier's work was independent of what we already had, but uses almost the same method at its core."

Today, Stevens said that the Zeus attack Trojan was actually using the Metasploit module. "From what I can read, the new Zeus PDF actually uses a [Metasploit] Adobe PDF exploit," Stevens said on Twitter , pointing to another description of the new attack by M86 Security of Orange, Calif.

Although Reader and Acrobat display a warning when an executable inside a PDF file is launched, that's not enough to stop users from launching the bogus document, said Websense's Hubbard. "No one is blanket-blocking PDFs at the gateway," he said. "There's so much business value in PDFs, and they're very pervasive." In other words, people trust PDFs, he said -- much more even than some other popular document formats, such as Microsoft Word.

Websense has tracked several thousand Zeus attacks using the embedded malware and /Launch function. "The attacks are still going on," Hubbard said.

While the attack technique may be new, the behind-the-scenes malware and the gang that produces it is standard Zeus fare, Hubbard continued. Zeus is best known for planting identity theft code on victims' PC to steal, for instance, online banking logon usernames and passwords. "The motives aren't any different here," said Hubbard.

Last week, Mickey Boodaei, CEO of security company Trusteer, bet that the /Launch function would be quickly exploited by hackers to infect PCs with financial malware. Stevens has not released proof-of-concept attack code, but Trusteer's engineers were easily able to duplicate his attack. Zeus' creators seem to have taken an even quicker shortcut by grabbing code from Ames' Metasploit module.

"This definitely gives them another tool in their arsenal," added Hubbard, referring to the Zeus botnet operators.

Now that Zeus has weaponized the /Launch tactic, other hackers will likely pick it up as well. "That's not uncommon," said Hubbard, "especially if there's a Metasploit module for it."

Adobe did not immediately reply to questions about whether Zeus' use of /Launch in rigged PDFs would prompt the company to release a patch for Reader and Acrobat. Previously, Adobe has acknowledged the bug, but has not committed to producing a patch. Instead, the company has urged users to change Reader's and Acrobat's settings to disable the vulnerable function .

Since then, Brad Arkin, Adobe's director for product security and privacy, said that one way the company could address the issue would be to update Reader and Acrobat so that the feature is disabled. Currently, Adobe's software turns on the /Launch function by default.

Adobe has posted instructions on how to configure Reader and Acrobat to stymie the attacks that Zeus is now conducting.

Tags Zeus botnetsecuritybotnets

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?