#Portal flash version hacked software
#Portal flash version hacked code
#Portal flash version hacked windows 7

#Portal flash version hacked software

We have described a technique used by attackers to performВ reconnaissance that gives them information about potential targets, including software and Antivirus versions. Here are some statistics generated based on the data collected by the attackers since June 21st:ДЄs we have previously discussed, the number of state-sponsored incidents involvingВ Southeast Asian Nations have been increasing steeply during the last months, specially those related to non-governmental organizationsВ ( NGOs). The function uses the following array of files, cut out:Дue to an error on the malicious server, we were able to get the logs generated by the icon.js requests. If the image can be loaded it means the DLL is present and the software is installed on the system.Д®xploring the resource section of the executable we can find the resource named 143 within the Bitmap directory This technique tries to load an image embedded on the resource section of a Dll/Exe. The function that performs the check is the following. This method seems to work only with Internet Explorer <= 8. The tricky part on this file is that it uses a list of software to check the presence of known files on the system, mainly Antivirus.

#Portal flash version hacked code

Once loaded, the javascript code sends the following information to an external server: It seems this file is included to doВ reconnaissance obtaining information about the visitorвЂ™s system. The flash file is in charge of heap spraying and setting up the shellcode that drops the malicious payload on the system.ДЄnother interesting file included is icon.js that is loaded from an external server.

#Portal flash version hacked windows 7

Therefore if the system is running Windows XP or the system is running Windows 7 with Java JRE 1.6 the flash file Geoffrey.swf is loaded.

The malicious code checks the operating system version, as well as the Java JREs present on the system using the javascript file deployJava.js. In this case, a Thailand NGO portal related toВ ASEAN human rights has been hacked and malicious code has been planted on the site, infecting the users that visit the portal.Д®very time a page is displayed to the visitor the content is modified and some html is appended to it:ДЄs can be seen, the file news.html is opened with every request and contains the actual exploit code: It shares exploit code as well as server infrastructure, meaning that it seems to be the same group is behind all these attacks. We have recently found another website exploiting this vulnerability that is related to the attacks reported by Sophos. TheВ CVE-2012-1889 vulnerability is related to GoogleвЂ™s warnings on state-sponsored attacksВ . During the previous days, Sophos has reported several attacks related to the Windows XML Core zero-day vulnerability: