DaVinci surveillance malware distributed via zero-day Flash Player exploit, researchers say

The attacks targeted activists from the Middle East, according to Kaspersky Lab researchers

By Lucian Constantin, IDG News Service |  Security

Political activists from the Middle East were targeted in attacks that exploited a previously unknown Flash Player vulnerability to install a so-called lawful interception program designed for law enforcement use, security researchers from antivirus vendor Kaspersky Lab said Tuesday.

Last Thursday, Adobe released an emergency update for Flash Player in order to address two zero-day -- unpatched -- vulnerabilities that were already being used in active attacks. In its security advisory at the time, Adobe credited Sergey Golovanov and Alexander Polyakov of Kaspersky Lab for reporting one of the two vulnerabilities, namely the one identified as CVE-2013-0633.

On Tuesday, the Kaspersky Lab researchers revealed more information about how they originally discovered the vulnerability. "The exploits for CVE-2013-0633 have been observed while monitoring the so-called 'legal' surveillance malware created by the Italian company HackingTeam," Golovanov said in a blog post.

HackingTeam is based in Milan but also has a presence in Annapolis, Maryland, and Singapore. According to its website, the company develops a computer surveillance program called Remote Control System (RCS) that is sold to law enforcement and intelligence agencies.

"Here in HackingTeam we believe that fighting crime should be easy: we provide effective, easy-to-use offensive technology to the worldwide law enforcement and intelligence communities," the company says on its website.

Kaspersky Lab has been monitoring HackingTeam's RCS -- also known as DaVinci -- since August 2012, said Costin Raiu, director of Kaspersky Lab's global research and analysis team.

RCS/DaVinci can record text and audio conversations from different chat programs, including Skype, Yahoo Messenger, Google Talk and MSN Messenger; can steal Web browsing history; can turn on a computer's microphone and webcam; can steal credentials stored in browsers and other programs, and much more, he said.

Kaspersky researchers have detected around 50 incidents so far that involved DaVinci being used against computer users from various countries including Italy, Mexico, Kazakhstan, Saudi Arabia, Turkey, Argentina, Algeria, Mali, Iran, India and Ethiopia.

The most recent attacks that were exploiting the CVE-2013-0633 vulnerability targeted activists from a country in the Middle East, Raiu said. However, he declined to name the country in order to avoid exposing information that could lead to the victims being identified.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

SecurityWhite Papers & Webcasts

See more White Papers | Webcasts

Ask a Question