Categories: HackingSecurity

MS Silverlight 5 flaw exposes 40M Netflix users to security risk

Users of Netflix, the provider of on-demand Internet streaming media, must beware of Silverlight exploit that could allow attackers to hack their systems.

A vulnerability in Microsoft Silverlight 5 exposes to the risk of cyber attacks nearly 40 million Netflix streamers, the flaw is being exploited to execute arbitrary code on victim’s systems without any user interaction. The risk is high and considering the wide audience of Netflix, during last weeks many popular web portals have been hacked including php.net , MacRumors and vBulletin with serious consequences for visitors, the websites in fact were used to serve malware and syphon members’personal information.
A few days ago Inj3ct0r Team of Exploit Database website 1337Day claimed the responsibility for the hack of the Macrumors official website based on vBulletin CMS, it announced to have exploited a Zero Day flaw for the attack.

Macrumors.com was based on vBulletin CMS. We use our 0day exploit vBulletin, got password moderator. 860000 user data hacked too. The network security is a myth
During the conversation, team leader told that he has discovered a Zero Day Remote Code Execution vulnerability in vBulletin v4.x.x and 5.х.x, that allows an attacker to execute arbitrary code on the server end remotely.
Netflix, Inc. is an American provider of on-demand Internet streaming media, a vulnerability in Silverlight could expose to hacking attacks those customers that watch Netflix via PC. Streaming functionality are implemented with Microsoft Silverlight application framework.
The attack scenario is very simple, a prompt asks Netflix members to download a plug-in:
“If you do not already have Microsoft Silverlight plug-in installed, you will be prompted to download and install the free plug-in for your web browser,”  “Just follow the instructions to get started.”

The attackers try to exploit a vulnerability (CVE-2013-0074) patched by Microsoft on March 12th, 2013, if the targeted machine is not up-to-date it is able to compromise the machine.

Malware.dontneedcoffee.com, aka Kafeine,  revealed that the Silverlight exploit has been integrated into the Angler exploit kit, so for the attacker it is just necessary to lure to an infected page the victim.

Kafeine reported that the Silverlight vulnerability is being used by the same cybercriminal gang behind the Reveton ransomware:

“Angler EK is definitely on the move. It’s not a huge surprise when we can speculate that the team behind is the same that was first using Cool EK (Paunch VIP customer) and is behind the Reveton threat.”

The Angler kit is a recent tool appeared in the underground as condequence of the arrest for the alleged creator of Blackhole exploit kit .

If a user is entice to an malicious page, the Angler exploit will determine if Silverlight is installed and what version is running. If the machine is a potential target, a specially crafted library is triggered to exploit the Silverligh vulnerability to serve a malware.

“Those that already have and older version of Silverlight can still watch Netflix and may not be aware that their computers are at risk,” “We can expect this CVE to be integrated into other exploit kits soon, so it is important to make sure you patch all your machines now. Even if you don’t watch Netflix, you may have installed Silverlight in the past and forgotten about it. If you don’t need Silverlight (or other plugins), simply remove it altogether as that will help to reduce your surface of attack.” wrote Jerome Segura, researcher at Malwarebytes.

Fortunatelly Netflix users, and more in general any internet user with Silverlight are invited to keep up to date their systems, this is necessary to avoid other data breaches considering that other exploit kit authors will integrate soon the code to exploit the vulnerability in their products.

Users are alerted and there will be no excuse in case of accidents

Pierluigi Paganini

(Security Affairs – Netflix, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

RansomHub ransomware gang relies on Kaspersky TDSKiller tool to disable EDR

Researchers observed the RansomHub ransomware group using the TDSSKiller tool to disable endpoint detection and…

4 mins ago

Ivanti fixed a maximum severity flaw in its Endpoint Management software (EPM)

Ivanti fixed a maximum severity flaw in its Endpoint Management software (EPM) that can let…

4 hours ago

Microsoft Patch Tuesday security updates for September 2024 addressed four actively exploited zero-days

Microsoft Patch Tuesday security updates for September 2024 addressed 79 flaws, including four actively exploited…

6 hours ago

Quad7 botnet evolves to more stealthy tactics to evade detection

The Quad7 botnet evolves and targets new  SOHO devices, including Axentra media servers, Ruckus wireless…

17 hours ago

Poland thwarted cyberattacks that were carried out by Russia and Belarus

Poland 's security officials announced that they successfully thwarted cyberattacks that were carried out by…

1 day ago

U.S. CISA adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SonicOS, ImageMagick and Linux Kernel bugs to…

1 day ago

This website uses cookies.