Pierluigi Paganini June 20, 2019

Researchers discovered that recently patched Firefox zero-day (CVE-2019-11707) has been exploited to deliver Windows and Mac malware to cryptocurrency exchanges.

Experts discovered that recently patched Firefox zero-day vulnerability (CVE-2019-11707) has been exploited by threat actors to deliver Windows and Mac malware to employees of cryptocurrency exchanges.

CVE-2019-11707 is a type confusion vulnerability in Array.pop. Mozilla has addressed it with the release of Firefox 67.0.3 and Firefox ESR 60.7.1.

Developers at the Tor Project have released the Tor Browser 8.5.2 to address the recently fixed CVE-2019-11707 zero-day flaw in Mozilla Firefox.

The flaw was reported by Coinbase Security and Samuel Groß of Google Project Zero team. Samuel Groß explained that he reported the bug to Mozilla on April 15, 2019.

The researcher explained that the vulnerability could be used for remote code execution if chained with a separate sandbox escape issue.

Philip Martin from Coinbase security team revealed that threat actors exploited the CVE-2019-11707 alongside another an unpatched Firefox sandbox escape flaw in targeted attacks against Coinbase employees. According to Martin, other cryptocurrency organizations were hit by similar attacks.

Security researcher Nick Carr from FireEye revealed that his company observed a series of attacks with many similarities that hit financial institutions and cryptocurrency exchanges between 2017 and 2019.

“After seeing the indicators of compromise (IoCs) made public by Martin, including malware hashes and command and control (C&C) IP addresses, FireEye’s Nick Carr revealed that they matched uncategorized activity observed by FireEye between 2017 and 2019.” reported SecurityWeek.

The popular malware researcher Vitali Kremez published an interesting analysis of macOS and Windows malware delivered through the exploitation of the CVE-2019-11707 flaw. The expert uncovered some connections with a recent wave of attacks exploiting a WinRAR zero-day.

The former NSA white hat hacker and macOS security expert Patrick Wardle analyzed some samples of macOS malware delivered via CVE-2019-11707.

Wardle received an email from a user who told him that he was the target of an attack that was exploiting an unknown Firefox flaw to drop a malicious binary on his macOS.

The man received the malware via an email that referenced the Adams Prize of the University of Cambridge.

“Note that the hash mentioned by Phil [Philip Martin], 23017a55b3d25a2597b7148214fd8fb2372591a5 matches malicious file which the user sent me.” wrote Wardle. “Moreover the user confirmed that he was “involved with a cryptocurrency exchange until fairly recently.” Thus it seems reasonable to assume we’re all talking about the same Firefox 0day.”

The expert detected the payload as OSX.Netwire (Wirenet), a password stealer for Linux and OS X systems that was first detected back in 2012.

Wardle only anticipated that the new variant includes many other features that he will detail in a forthcoming post, he pointed out that it bypassed Apple’s Gatekeeper security mechanism.

“Recall that in his original email, the infected user noted that the malware bypassed Gatekeeper. This is actually unsurprising as the malware was delivered by a remote 0day exploit. Gatekeeper only scans applications that have a quarantine attribute set.” concludes the expert “This is added by the application (i.e. browser) or OS only when the application is downloaded via normal means (i.e. by the user). Exploit code that downloads a payload (such as malicious application) will not set a quarantine attribute (or can remove it), thus will not trigger Gatekeeper! “

Pierluigi Paganini

(SecurityAffairs – CVE-2019-11707, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]