Patched Adobe zero-day exploit used successfully (again)
Last week Adobe issued an emergency patch for a zero-day exploit discovered by FireEye just eight days ago. &nbsp;But today reports are coming through that within just four days of the patch being made, the original zero-day exploit was being used by other groups in larger attacks. &nbsp;The point here is that companies need to be far quicker at installing emergency patches. Adobe issued the Adobe Player patch on Tuesday; by Saturday the exploit (discovered on Tuesday) was out on the deepweb being offered to hackers, who by that time had installed it into a commercially available exploit-kit and had used it effectively. &nbsp;This suggests &nbsp;that the makers of exploit-kits are able to be alerted to "new" zero-days and have them on the market for further exploitation within 72-hours or less. &nbsp;How many companies install patches across their user bases that quickly?
It only took four days for a recently patched vulnerability in Flash Player to start being used in large-scale attacks

Just four days after Adobe Systems patched a vulnerability in Flash Player, the exploit was adopted by cybercriminals for use in large-scale attacks. This highlights the increasingly small time frame users have to deploy patches.

On Saturday, a malware researcher known online as Kafeine spotted a drive-by download attack done with the Magnitude exploit kit that was exploiting a Flash Player vulnerability patched Tuesday.

The flaw, tracked as CVE-2015-3113 in the Common Vulnerabilities and Exposures database, had zero-day status -- that is, it was previously unpatched -- when Adobe released a patch for it. It had already been exploited by a China-based cyberespionage group for several weeks in targeted attacks against organizations from the aerospace, defense, construction, engineering, technology, telecommunications and transportation industries.

It is not unusual to see zero-day exploits for Flash Player and other popular applications being used in highly targeted cyberespionage attacks. That's because the goal of the attackers behind them is to compromise organizations that sometimes have sophisticated defenses and to remain undetected for as long as possible.

On the other hand, while zero-day exploits have been used in more indiscriminate, large-scale attacks, such incidents are rare. That's because zero-day vulnerabilities are extremely valuable and it doesn't make financial sense for attackers to burn them in noisy campaigns where they'll be very quickly discovered and patched.

Therefore, it's much more common for the creators of commercial exploit kits like Magnitude to integrate exploits for already patched vulnerabilities. For them it's a numbers game and there's always a large number of users who fail to install updates in a timely manner if at all.

But it seems that while computer users have not significantly improved their patching times, the exploit kit creators are aggressively reducing the time they need to integrate exploits.

The new Magnitude attacks left users with only four days to install the Flash Player patch for CVE-2015-3113, a very small time frame especially for organizations that typically deploy updates according to predetermined schedules that are often more than one week apart.

Earlier this year the authors of another exploit kit, Nuclear EK, integrated a Flash Player exploit a week after Adobe patched it, signaling a trend toward increasingly smaller patch windows.

The new Magnitude attacks that exploit CVE-2015-3113, if successful, install the Cryptowall ransomware. However, the payload could be changed by the attackers to something else at any time.