Targeted attacks using malicious PDF files
April 24, 2008 – 12:14 PMDating back to the end of February, we have been tracking test runs of malicious PDF messages to very specific targets. These PDF files exploit the recent vulnerability CVE-2008-0655.
Ever since the end of March, beginning of April, the amount of samples seen in the wild has significantly increased. Interestingly enough, there is almost no “public, widespread” exploitation. All reports are limited to very specific, targeted attacks. However, due to the wide scope of these attacks, and the number of targets we know of, we feel a diary entry was in order.
At this point in time, we are receiving more PDF samples from targeted attack victims per day than any other common file type (DOC, CHM, PPT). The threat agents, or attackers, are the same. They are just moving from other file types towards PDF, but are generally using the same control servers and similar backdoor families.
The files contain:
– an embedded trojan installer;
– a clean PDF file.
Once the file is opened in a vulnerable Acrobat Reader version, the backdoor will install, and the clean PDF file is opened in the user’s browser. From a user experience, there are two possible methods of detection:
– If the file is opened in a patched Acrobat Reader, an error will be displayed that the file is corrupted;
– If the file is opened in a vulnerable Acrobat Reader, the user will see Acrobat Reader close and immediately reopen the valid PDF document.
Anti virus detection of these samples is usually very low heuristically. The below are detection results from a malicious PDF which had not been reported to an AV vendor yet. Note that these results vary per file. We’re not listing MD5 hashes or file names due to the sheer number of samples we’ve seen so far.
You must be logged in to post a comment.