The Hacking Team Leak, Zero-Days, Patches, and More Zero-Days [updated] – Trend Micro

Business
Improve your risk posture with attack surface management
Security that enables business outcomes
Gain visibility and meet business needs with security
Connect with confidence from anywhere, on any device
Secure users and key operations throughout your environment
Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities
Maximize effectiveness with proactive risk reduction and managed services
Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console
Drive business value with measurable cybersecurity outcomes
See more, act faster
Evolve your security to mitigate threats quickly and effectively
Ensure code runs only as intended
Gain visibility and control with security designed for cloud environments
Protect patient data, devices, and networks while meeting regulations
Protecting your factory environments – from traditional devices to state-of-the-art infrastructures
ICS/OT Security for the oil and gas utility industry
ICS/OT Security for the electric utility
Stop threats with easy-to-use solutions designed for your growing business
Bridge threat protection and cyber risk management
Your generative AI cybersecurity assistant
Stop breaches before they happen
Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform
The most trusted cloud security platform for developers, security teams, and businesses
Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one
Extend visibility to the cloud and streamline SOC investigations
Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities
Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection
Protect application workflow and cloud storage against advanced threats
Defend the endpoint through every stage of an attack
Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform
Optimized prevention, detection, and response for endpoints, servers, and cloud workloads
On-premises and cloud protection against malware, malicious applications, and other mobile threats
Expand the power of XDR with network detection and response
Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform
Protect against known, unknown, and undisclosed vulnerabilities in your network
Detect and respond to targeted attacks moving inbound, outbound, and laterally
Redefine trust and secure digital transformation with continuous risk assessments
Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise
Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace
Learn about solutions for ICS / OT security.
Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform
See threats coming from miles away
End-to-end identity security from identity posture management to detection and response
Prevent, detect, respond and protect without compromising data sovereignty
Augment security teams with 24/7/365 managed detection, response, and support
Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks
Our trusted experts are on call whether you’re experiencing a breach or looking to proactively improve your IR plans
Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs
Grow your business and protect your customers with the best-in-class complete, multilayered security
Stand out to customers with competency endorsements that showcase your expertise
Deliver modern security operations services with our industry-leading XDR
Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs
We work with the best to help you optimize performance and value
Discover resources designed to accelerate your business’s growth and enhance your capabilities as a Trend Micro partner
Accelerate your learning with Trend Campus, an easy-to-use education platform that offers personalized technical guidance
Access collaborative services designed to help you showcase the value of Trend Vision One™ and grow your business
Locate a partner from whom you can purchase Trend Micro solutions
See how Trend outperforms the competition
Crowdstrike provides effective cybersecurity through its cloud-native platform, but its pricing may stretch budgets, especially for organizations seeking cost-effective scalability through a true single platform
Microsoft offers a foundational layer of protection, yet it often requires supplemental solutions to fully address customers’ security problems
Palo Alto Networks delivers advanced cybersecurity solutions, but navigating its comprehensive suite can be complex and unlocking all capabilities requires significant investment
A lot has happened since the surveillance software company Hacking Team got hacked last week. The breach exposed hundreds of gigabytes of their internal data online—including proof-of-concept exploits for Adobe Flash Player vulnerabilities, and one for the Windows Kernel—basically opening a Pandora’s box of exploits and vulnerabilities to the Internet. 
Evidently, a lot of individuals opened that box, saw what was inside, and ran with it. After the leak, a number of exploit kits 1
have been updated to include the exploit for the first Flash vulnerability (CVE-2015-5119), which, according to Adobe, affected all versions of Flash Player. The first identified zero-day vulnerability has already been acknowledged and patched by Adobe on July 8th.
It didn’t stop there though. A few days later, another zero-day vulnerability (CVE-2015-5122) was found from the Hacking Team leak that, if exploited, could allow an attacker to take control of the vulnerable system. This second known vulnerability was identified as a proof-of-concept that currently remains unpatched. A third zero-day vulnerability (CVE-2015-5123)—another POC from the Hacking Team leak—surfaced shortly after.
The two new vulnerabilities make for three Adobe Flash Player vulnerabilities in a week. Both CVE-2015-5122 and CVE-2015-5123 remain unpatched, and it’s recommended that users temporarily disable Flash to avoid possible attacks. Trend Micro Deep Security features vulnerability protection that protects users from threats related to this vulnerability. 
Adobe has released a security advisory that tags them as critical vulnerabilities that affect Flash Player 18.0.0.204 and earlier versions for Windows, Mac, and Linux. Adobe expects to release an update that fixes these two vulnerabilities “during the week of July 12, 2015.” Stay tuned for updates. 
Update – July 14: After finding three separate zero-days that affected Adobe Flash, another zero-day—still connected to the Hacking Team incident—has been discovered. Designated as CVE-2015-2425, this vulnerability is an Internet Explorer flaw that can allow an attacker to take over a user’s system. There are no known attacks that exploit this vulnerability, but Microsoft has published a security bulletin for the critical flaw, and has already released a fix for this in their latest Patch Tuesday update.
Update – July 16: The Hacking Team’s leaked files totaled 400GB, and it wasn’t limited to vulnerabilities. An analysis of the files also revealed mobile threats that can affect iOS and Android platforms. First came a report about HT’s surveillance software that could be slipped into a non-jailbroken phone. Then Trend Micro researchers found a fake news app that can circumvent filtering in Google Play. Called “BeNews”, it’s possible that the app was used as a lure for downloading RCSAndroid malware into a target’s device. 2
Update – July 20: A Windows zero-day vulnerability has been discovered in the Hacking Team’s leaked files. Discovered by Trend Micro researchers, the vulnerability could be used to cause a Windows local privilege escalation (LPE) that would allow attackers to infect a victim’s system. Exploiting this flaw could allow an attacker to remotely control the affected system . The vulnerability (CVE-2015-2426) has already been reported to Microsoft, and a patch has already been released to fix it.
Update – July 21: More on the mobile front: the code for Hacking Team’s open-source malware suite RCSAndroid (Remote Control System Android) has been found in the leaked files. The company was selling RCSAndroid as a tool for monitoring targets. The code can be considered as one of the most sophisticated, professionally developed Android malware ever exposed, and allows the RCSAndroid app to run a number of intrusive spy routines. 3
It’s very powerful, and it’s currently out in the wild and available for cybercriminals to tweak for their purposes.
For now, users are recommended to avoid installing apps from third-party sources, update to the latest OS version, and install a mobile security solution. 4
Mobile Security for Android can protect against these types of attacks.
[More:
7 Android Security Hacks You Need to Do Right Now]
For more technical details on the Hacking Team leak and the discovered zero-days, here are the latest updates from the TrendLabs Security Intelligence Blog:
Like it? Add this infographic to your site:
1. Click on the box below.   2. Press Ctrl+A to select all.   3. Press Ctrl+C to copy.   4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
View the 2024 Trend Micro Security Predictions
View the report
Try our services free for 30 days
Trend Micro – United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
Copyright ©2024 Trend Micro Incorporated. All rights reserved

source