Topic: "Belmoo" Malware exploit Firefox 0day vulnerability on Nobel Peace Prize website

[Samker]

Malicious hackers have exploited an unpatched vulnerability in the latest version of Firefox to attack people visiting the Nobel Peace Prize website, a Norway-based security firm said on Tuesday.

Mozilla representatives confirmed a "critical vulnerability" in versions 3.5 and 3.6 of the open-source browser. It came several hours after the organization members were said to have made the same admission on this password-protected Bugzilla page: https://bugzilla.mozilla.org/show_bug.cgi?id=607222

According to Einar Oftedal, a detection executive at Norman ASA in Oslo, the official website for the Nobel Peace prize, nobelpeaceprize.org, was compromised so that it contained an iframe link to a malicious server.

“This iframe has a multi exploit backend and serves exploits for Firefox, including a working remote exploit for firefox 3.6.11,” he said in an instant message to The Register. “We didn't see any 0day for IE,” he added, referring to Microsoft's browser.

He said the attack exploited a race condition vulnerability in Firefox to force end users to install malware his firm has dubbed Belmoo: http://norman.com/security_center/virus_description_archive/129146/
The Windows executable was created on Sunday and attempts to connect to several internet addresses, according to his analysis.

If the addresses resolve, “the malware attaches a command shell to the opened socket, giving an attacker access on the local computer with the same rights as the logged on user.” If not, the malware will exit.

If Norman's report proves accurate, it's the first time in recent memory attackers have exploited an unpatched vulnerability in Firefox: http://norman.com/about_norman/press_center/news_archive/2010/129223/en
Most so-called zero-day attacks are perpetrated against Adobe Reader or Flash Player, Microsoft software and to a lesser extent Oracle's Java. The report is also unusual because the attack didn't appear to target other applications, as is typical with exploit packages.

Hours after the reports surfaced, Mozilla said it would issue a fix as soon as possible: http://blog.mozilla.com/security/2010/10/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/
In the meantime, users can protect themselves by disabling JavaScript altogether or installing the NoScript extension that allows users to control which websites are permitted to run JavaScript. Download NoScript: https://addons.mozilla.org/en-US/firefox/addon/722/

The reported attack comes less than three weeks after jailed Chinese dissent Liu Xiaobo won the Nobel Peace Prize. The 54-year-old former university professor was sentenced in December to 11 years in prison for co-authoring Charter 08, a manifesto that strongly condemned China's one-party Communist government. Beijing considers him a criminal and has voiced its discontent to Norway.

(ElReg)

[Samker]

Mozilla quickly patches Firefox flaw


Mozilla has reacted quickly to patch a zero-day vulnerability in its Firefox browser software.

The security flaw was used to run a drive-by-download attack so that Firefox fans visiting the website for the Nobel Peace prize were exposed to malware on Tuesday.

Code planted on the site redirected surfers to a hacker-controlled site that ran a JavaScript-based exploit, specific to Firefox, that attempted to plant a Trojan on vulnerable Windows PCs.

The mechanism of the attack, detected by security researchers on Tuesday, is blocked with the release of the latest version of the open source web browser, Firefox 3.6.12: http://www.mozilla.com/en-US/firefox/3.6.12/releasenotes
Mozilla has also released a cross-platform update for the earlier version 3.5.x version of the browser that addresses the same security hole.

The underlying vulnerability affects Mac OS X and Linux as well as Windows boxes running Firefox, hence the need for a cross-platform update even though the Nobel Prize site attack was Windows-specific. Firefox 4 beta is immune from the vulnerability, hence there's no need to update existing pre-release versions of the browser, due to make its delayed debut in early 2011.

Mozilla credits Norwegian security vendor Telenor with discovering the flaw: http://telenorsoc.blogspot.com/

More details on the attack can be found in a blog post by anti-virus scanner firm Avira here: http://techblog.avira.com/2010/10/27/new-firefox-exploit-in-the-wild/en

Avira dismisses the malware that featured in the attack as an amateurish and unreliable effort. "It is currently unclear why obviously a script-kiddie-like malware abuses such a valuable zeroday vulnerability; usually cyber criminals abuse them for profitable malware," it said.

(ElReg)