Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Researchers find previously unknown exploits among Hacking Team's leaked files

Lucian Constantin | July 8, 2015
At least one new exploit for Flash Player has been confirmed.

One of the confirmed zero-day exploits found in the data dump affects Flash Player and can be used to infect computers when their users visit websites in Internet Explorer.

Carsten Eiram, the chief research officer at vulnerability intelligence firm Risk Based Security, tested the exploit and confirmed that it works reliably against the latest version of Flash Player running under Internet Explorer 11 on Windows 7 32-bit.

"We have not been able to get it to run on a fully patched Win 8.1 Pro with Flash installed, but it may just require some tweaking to get around additional protection mechanisms," Eiram said via email.

Adobe is aware of the reported exploit and expects to release an update for Flash Player Wednesday, an Adobe representative said via email.

There were also reports on Twitter from other security researchers about a zero-day exploit in win32k.sys, a Windows component, being found in the Hacking Team data.

Researchers from antivirus firm Trend Micro said in a blog post that the leaked Hacking Team files contain two exploits for Flash Player, one of which is already known and has been patched, and one for the Windows kernel.

Eiram's team is also looking at a potentially new Windows privilege escalation exploit that might be the same one mentioned in the other reports, but he couldn't comment beyond that because the issue hasn't been fully investigated or confirmed.

"We believe the overall risk for customers is limited, as this vulnerability could not, on its own, allow an adversary to take control of a machine," a Microsoft representative said via email. "We encourage customers to apply the Adobe update and are working on a fix to address this problem."

Other users reported on Twitter and Reddit that Hacking Team's data also contains an exploit for bypassing the SELinux enforcements, but that has yet to be confirmed as well.

The Hacking Team data leak and revelations come amid proposed changes to an international arms control pact called the Wassenaar Arrangement, that would restrict the export of exploits and other computer intrusion software.

This story has been updated at 9:25 AM PT with comments from Microsoft.

 

Previous Page  1  2 

Sign up for Computerworld eNewsletters.