Flash exploit used to steal gaming passwords

Despite initial panic, threat no longer believed to a zero-day exploit.

In the past few days, thousands of websites have indirectly been serving malicious

Adobe Flash

(.SWF) files. It is believed that legitimate sites have been hacked via SQL injection to include a script that causes browsers to redirect to sites hosting malicious .SWF files. The

Flash

files reside on various domains in China and exploit a vulnerability in the

Flash Player

to download trojans capable of stealing passwords for the popular

World of Warcraft

game.

Originally, it was thought to be a zero-day exploit, causing panic among Internet users and raising questions among security researchers as to why such an opportunity was being used by malware authors for something as relatively fruitless as the stealing of gaming passwords. However, researchers at

Symantec

have since confirmed that the flaw has been patched in the latest version of

Flash

(9.0.124.0) and, consequently, they have

lowered the threat level

to ‘Normal’.

Users are still advised to

check which version

of

Flash

they are running for every browser they use. If this turns out to be a version prior to 9.0.124.0, users are advised to upgrade immediately or, if unable to do so, to disable

Flash

. As many of the websites used in the attack are genuine sites that have been hacked, ‘careful surfing’ will not help prevent infection.

Posted on 29 May 2008 by

Virus Bulletin