Malicious hackers have pounced on a newly patched Adobe PDF Reader vulnerability to plant Trojan downloaders on tardy Windows users.
According to researchers in Microsoft’s malware protection center, the vulnerability (CVE-2010-0188) was patched less than a month ago, proving that malicious hackers are quick to find fresh targets for malware.
Microsoft’s Marian Radu explains:
While recently analyzing a malicious PDF file, I noticed a vulnerability exploited by the sample which I’ve never encountered before. After a bit of research I came to the conclusion that this specific sample exploited CVE-2010-0188.
This is a fresh vulnerability, information about which was just published this February. It is described as possibly leading to arbitrary code execution, which is exactly what’s happening.
Madu said the malicious PDF causes Adobe Reader to open and then close. While this is happening, an executable file named a.exe is dropped directly onto the C: drive.
The dropped executable, which is actually embedded into the PDF file, tries to connect to a .biz registered domain to download other files. JavaScript is again used to successfully exploit this vulnerability, so disabling it for unknown documents might be a good idea.
Only Windows users who have not yet updated to the newest version of Adobe Reader are vulnerable to this threat.
Separately, the folks at F-Secure has released a chart showing the gradual growth of Adobe Reader as the most commonly exploited software in targeted attacks.
