A recently patched Flash Player exploit is being used in widespread attacks

An exploit for the previously zero-day CVE-2016-4117 vulnerability is now in the Magnitude exploit kit

It took hackers less than two weeks to integrate a recently patched Flash Player exploit into widely used Web-based attack tools that are being used to infect computers with malware.

The vulnerability, known as CVE-2016-4117, was discovered earlier this month by security researchers FireEye. It was exploited in targeted attacks through malicious Flash content embedded in Microsoft Office documents.

When the targeted exploit was discovered, the vulnerability was unpatched, which prompted a security alert from Adobe Systems and a patch two days later.

As it usually happens with zero-day exploits, it was only a matter of time until more cybercriminals got their hands on the CVE-2016-4117 exploit code and started using it in widespread attacks.

On Saturday, a malware researcher known as Kafeine spotted the exploit in Magnitude, one of the most popular exploit kits used by cybercriminals.

Exploit kits are Web-based attack tools that bundle multiple exploits for vulnerabilities in browser plug-ins like Flash Player, Java, Silverlight and Adobe Reader. They are used to silently install malware on users' computers when they visit malicious or compromised websites.

Another way to direct users to exploit kits is through malicious ads posted on legitimate websites, a technique known as malvertising.

Unlike cyberespionage groups, exploit kit creators and operators don't mind if their exploits are for patched vulnerabilities, because they count on the fact that a large number of users don't frequently update their software.

However, the fact that it took them less than two weeks to find the exploit and add it to their tools, increases the number potential victims with a vulnerable Flash Player installations.

In order to stay protected users should make sure that they're running the latest version of Flash Player available for their browser and should also make sure that the other browser plug-ins are also up to date.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?