TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 19, 2018

Earlier this week, Trend Micro released its Security Roundup for 2017, which reveals an increase in ransomware, cryptocurrency mining and business email compromise BEC attempts over the past year as cybercriminals refined and targeted their attacks for greater financial return. Surprisingly, some...

skia/path_deserialize: Heap-buffer-overflow in SkPath::moveTo

Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5078673775394816 Project: skia Fuzzer: libFuzzerskiapathdeserialize Fuzz target binary: pathdeserialize Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash...

APT37 (Reaper): The Overlooked North Korean Actor

On Feb. 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability CVE-2018-4878 by a suspected North Korean cyber espionage group that we now track as APT37 Reaper. Our analysis of APT37’s recent activity reveals that the group’s operations are expanding in scope and...

A week in security (February 12 – February 18)

Last week on Malwarebytes Labs, we looked at a huge Android cryptomining campaign, malicious apps on Google Play, and some Apple scams doing the rounds. We also explored the world of healthcare security, and dived into the land of scammy Valentine's Day tricks and cheats. Other news Thought the...

libreoffice/pptfuzzer: Bad-cast to SdrObjectSdrEdgeObj::Notify in SfxBroadcaster::Broadcast

Detailed report: https://oss-fuzz.com/testcase?key=5146943924731904 Project: libreoffice Fuzzer: libFuzzerlibreofficepptfuzzer Fuzz target binary: pptfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash Address: 0x000010fd2e70 Crash State: Bad-cast to...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 12, 2018

Valentine’s Day was earlier this week, and there was so much love in the air. There was also a lot of love in the Trend Micro world as our teams worked diligently to make sure our customers were protected from this month’s bevy of critical vulnerabilities across several vendors. This week, we foc...

yara/dex_fuzzer: Heap-buffer-overflow in yr_object_set_string

Detailed report: https://oss-fuzz.com/testcase?key=5648916683948032 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x61b000000d8e Crash State: yrobjectsetstring...

chakra: Heap-double-free in Memory::SmallFinalizableHeapBlockT<SmallAllocationBlockAttributes>::FinalizeAllO

Project: https://github.com/Microsoft/ChakraCore.git Detailed report: https://oss-fuzz.com/testcase?key=4728057039421440 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x61100001a640 Crash State:...

libreoffice/tgafuzzer: Heap-buffer-overflow in vcl::bitmap::RawBitmap::SetPixel

Detailed report: https://oss-fuzz.com/testcase?key=5733672629043200 Project: libreoffice Fuzzer: afllibreofficetgafuzzer Fuzz target binary: tgafuzzer Job Type: aflasanlibreoffice Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x603000027651 Crash State:...

Hackers Exploiting 'Bitmessage' Zero-Day to Steal Bitcoin Wallet Keys

Bitmessage developers have warned of a critical 'remotely executable' zero-day vulnerability in the PyBitmessage application that was being exploited in the wild. Bitmessage is a Peer-to-Peer P2P communications protocol used to send encrypted messages to users. Since it is decentralized and...

February 14, 2018 – Morning Cyber Coffee Headlines – “Valentine’s Day” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! February 14 2018 - Headlines Carbon Black in the News: Endpoint security suites...

Hackers Exploit 'Telegram Messenger' Zero-Day Flaw to Spread Malware

A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash. The Telegram vulnerability was uncovered by security researcher...

Romance Scams Drive Necurs Botnet Activity in Run Up to Valentine’s Day

Necurs botnet activity is spiking as scammers use the network to flood inboxes with promises of companionship, in part of a seasonal wave of Valentine’s Day-themed spam. Victims are encouraged to share revealing photos of themselves, which scammers later use as leverage in extortion shakedowns. T...

graphicsmagick/coder_PICT_fuzzer: Unknown signal in DestroyCacheInfo

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6624475274543104 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPICTfuzzer Fuzz target binary: coderPICTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/encoder_miff_fuzzer: Stack-buffer-overflow in QueryColorCompliance

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4843070479663104 Project: imagemagick Fuzzer: aflimagemagickencodermifffuzzer Fuzz target binary: encodermifffuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type:...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 5, 2018

It was a busy week in the cyber security world, but it shouldn’t be surprising given that the 2018 Winter Olympics in Pyeongchang have begun. I shouldn’t blame just the Olympics, but it’s hard not to given the international focus, controversy around the ban of certain athletes and its proximity t...

yara/dex_fuzzer: Heap-buffer-overflow in dex_parse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5104899873308672 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62e0000178f8...

imagemagick/encoder_mvg_fuzzer: Heap-buffer-overflow in FileToBlob

Detailed report: https://oss-fuzz.com/testcase?key=4892658276237312 Project: imagemagick Fuzzer: aflimagemagickencodermvgfuzzer Fuzz target binary: encodermvgfuzzer Job Type: aflasanimagemagick Platform Id: linux Crash Type: Heap-buffer-overflow WRITE \ Crash Address: 0x63200002c801 Crash State:...

graphicsmagick/coder_PCT_fuzzer: Unknown signal in AcquireString

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=6515514101727232 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderPCTfuzzer Fuzz target binary: coderPCTfuzzer Job Type: libfuzzerubsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/rotate_fuzzer: Use-of-uninitialized-value in PerceptibleReciprocal

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=4686820978720768 Project: imagemagick Fuzzer: libFuzzerimagemagickrotatefuzzer Fuzz target binary: rotatefuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...