Malware Served Through Flash Exploits By MSN Norway
Morten Krakvik from the Norwegian Honeynet Project is reporting that MSN Norway is among the latest victims of malvertising, a practice where a bogus advertising provider tricks leading portals into accepting advertisements from its network, which often end up redirecting to live exploit URLs. The recent wave of malvertising that also targeted Digg, MSNBC and Newsweek, is very similar to the malvertising campaigns that took place in February which were targeting popular sites as Expedia, Excite, Rhapsody and MySpace. The only thing the malvertisers keep changing are the fake security software domains that they push through their campaigns.
Vulnerable Flash player versions are:
Adobe Flash 9.0.16
Adobe Flash 9.0.28
Adobe Flash 9.0.45
Adobe Flash 9.0.47
Adobe Flash 9.0.115
According to Krakvik’s analysis, the malicious ad came from bannersrotator.com which is still active (do not visit it) and serving the malicious ad file tunnel28.swf. Currently it is detected by 9 out of 36 anti-virus scanners as SWF:CVE-2007-0071, or SWF.Exploit.
Users are advised to patching their operating system, browser, Flash player and use browser extensions like NoScript for Firefox, as we mentioned countless times before.
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.