Zeus botnet exploits unpatched PDF flaw

The Zeus botnet is now using an unpatched flaw in Adobe's PDF document format to infect users with malicious code, security researchers said today.

The attacks come less than a week after other experts predicted that hackers would soon exploit the "/Launch" design flaw in PDF documents to install malware on unsuspecting users' computers.

The just-spotted Zeus variant uses a malicious PDF file that embeds the attack code in the document, said Dan Hubbard, CTO of San Diego, Calif.-based security company Websense. When users open the rogue PDF, they're asked to save a PDF file called "Royal_Mail_Delivery_Notice.pdf." That file, however, is actually a Windows executable that when it runs, hijacks the PC.

Zeus is the first major botnet to exploit a PDF's /Launch feature, which is, strictly speaking, not a security vulnerability but actually a by-design function of Adobe's specification. Earlier this month, Belgium researcher Didier Stevens demonstrated how a multistage attack using /Launch could successfully exploit a fully-patched copy of Adobe Reader or Acrobat.

Stevens was not the first to reveal the /Launch vulnerability. In August 2009, a module using the same flaw was added to the open-source Metasploit penetration testing kit, said HD Moore, Metasploit's creator and the chief security officer at Rapid7. "Colin Ames of Attack Research wrote this module as part of his Black Hat USA presentation," said Moore. "Didier's work was independent of what we already had, but uses almost the same method at its core."

Today, Stevens said that the Zeus attack Trojan was actually using the Metasploit module. "From what I can read, the new Zeus PDF actually uses a [Metasploit] Adobe PDF exploit," Stevens said on Twitter , pointing to another description of the new attack by M86 Security of Orange, Calif.

Although Reader and Acrobat display a warning when an executable inside a PDF file is launched, that's not enough to stop users from launching the bogus document, said Websense's Hubbard. "No one is blanket-blocking PDFs at the gateway," he said. "There's so much business value in PDFs, and they're very pervasive." In other words, people trust PDFs, he said -- much more even than some other popular document formats, such as Microsoft Word.

Websense has tracked several thousand Zeus attacks using the embedded malware and /Launch function. "The attacks are still going on," Hubbard said.

While the attack technique may be new, the behind-the-scenes malware and the gang that produces it is standard Zeus fare, Hubbard continued. Zeus is best known for planting identity theft code on victims' PC to steal, for instance, online banking logon usernames and passwords. "The motives aren't any different here," said Hubbard.

Last week, Mickey Boodaei, CEO of security company Trusteer, bet that the /Launch function would be quickly exploited by hackers to infect PCs with financial malware. Stevens has not released proof-of-concept attack code, but Trusteer's engineers were easily able to duplicate his attack. Zeus' creators seem to have taken an even quicker shortcut by grabbing code from Ames' Metasploit module.

"This definitely gives them another tool in their arsenal," added Hubbard, referring to the Zeus botnet operators.

Now that Zeus has weaponized the /Launch tactic, other hackers will likely pick it up as well. "That's not uncommon," said Hubbard, "especially if there's a Metasploit module for it."

Adobe did not immediately reply to questions about whether Zeus' use of /Launch in rigged PDFs would prompt the company to release a patch for Reader and Acrobat. Previously, Adobe has acknowledged the bug, but has not committed to producing a patch. Instead, the company has urged users to change Reader's and Acrobat's settings to disable the vulnerable function .

Since then, Brad Arkin, Adobe's director for product security and privacy, said that one way the company could address the issue would be to update Reader and Acrobat so that the feature is disabled. Currently, Adobe's software turns on the /Launch function by default.

Adobe has posted instructions on how to configure Reader and Acrobat to stymie the attacks that Zeus is now conducting.