Adobe reader vulnerability demo [Anatomy of an Attack online]

Here's a demo on how a vulnerability in Adobe Reader allowed random content to be downloaded from the internet.
Find a live Anatomy of an Attack event near you: http://bit.ly/LxLwm4

• Category

  Science & Technology

[MrPhilippos96]

@S3b1Videos It didn't warn the user because the malware is digitally signed(certificated).

@SamKeupoN Yes,the buffer overflow itself is caused by a strcat API call on a

"custom"-size stack variable

[SamKeupoN]

My guess is that it uses a buffer overflow allowing code injection. The download is actually done by the injected code.

[TheHouseOfWaffles]

Why would Adobe Reader download another file when it crashes, and how would it know to where to get it? If a PDF file is corrupt or not an actual PDF at all, shouldn't Adobe Reader simply say, "This is not a PDF file, so I can't open it," then do nothing else? As far as I know, Adobe Reader isn't one those applications which take a plain-text-based malicious script file masquerading as something else like a JPEG, determine it's a script file and not the supposed file type, then runs the script.

[notta3d]

Damn Leadbetter!

[S3b1Videos]

But how did the exploit creator calculate the return adress if ASLR is enabled? Why Windows didn't warn the user of an stack execution or an overwritten variable?

[mp3talon]

i think he is canadian

[pilebaina]

Ok we have an American here...