Comments on Who is Exploiting the Adobe Flash 0-day?

bot commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-09-08T11:27:45Z

the same is true (i think) for a vista UAC "normal" user.

James Larsof commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-08-16T07:01:34Z

Will NoScript still protect against this sort of attack in a driveby download form, as it does against other driveby downloads? Or are we left high and dry here too? Thanks.

Fake Name commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-26T09:54:54Z

The best solution to simply use a 3rd party pdf reader.

SumatraPDF is Fast and open source:
http://blog.kowalczyk.info/software/sumatrapdf/index.html

Foxit reader is a bit more powerful, though it's closed source:
http://www.foxitsoftware.com/pdf/reader/

Both are far faster than acrobat, too.

H. Karimi commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-24T19:45:02Z

I have a question...

How do you guys find samples to analysis... I have a security blog too and I want to analyze and publish very detailed explanations about it, but I'm not able to find any sample for none of 0-day bugs... What should I do? How you find samples to analysis?

Please explain it if possible... I really need to know...
Here is my e-mail: hkarimi83 [at] yahoo [dot] com

If possible send me sample of this Flash file sample.

Thanks
Regards

iTinker commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-24T15:00:21Z

RE: mitigation

Q: would DEP (hardware+software, opt-in or always on) prevent the heap spray from succeeding?

Q: if the attacked (XP) user was a normal (not admin) user and was running under a "line of business" software restriction policy (SRP) the execution of any exe from %TEMP% should be blocked. the same is true (i think) for a vista UAC "normal" user. does the exe attempt any permission escalation to avoid this? is the attack successful against an XP normal user with SRP or a vista normal user with UAC?

heh commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-23T17:01:35Z

Did you notice that the server shows directory listings and right up front a phpmyadmin directory? hxxp://59.175.238.82/

Eric "Secrunner" commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-23T15:44:51Z

Very good analysis. I think this is further evidence that Adobe still needs to address their security announcements. The would do well to analyze beyond the entry-point. Of course, I'm sure from a PR angle, it's easier to say, "oh yeah, just disable this and your fixed...patch coming end of month", than to actually have to say, "yeah, it's nasty and there isn't a good fix beyond good AV until we have a patch available".

MarkN commented on 'Who is Exploiting the Adobe Flash 0-day?'

2009-07-23T15:19:40Z

Can you advise on the best way to analyse sys files?