Presented at
VB2017,
Oct. 6, 2017, 9:30 a.m.
(30 minutes)
Lately, we have observed a zero-day vulnerability in the *InPage* text processing and publishing software being used in attacks in Middle Asia, the Arabian Peninsula and North Africa. The discovery of these attacks was interesting because the actor we have identified as being behind some of them had previously relied on old and previously known exploits, such as an *MS Office* TIFF exploit, but in recent times has shown technical progress and in some cases has changed tactics.
The software exploited in this case, *InPage*, supports Urdu, Arabic, Pushtu and other regional languages. In choosing vulnerable software, threat actors can target precise regions, social groups, and even industries of specific interest. In this presentation we'll look in detail at the latest developments in the attack campaign, and will disclose technical details about the *InPage* exploit and how it works. Note that this exploit has also been used in attacks against Asian and African banks.
Presenters:
-
Denis Legezo
- Kaspersky Lab
Denis Legezo Denis Legezo works at Kaspersky Lab as a security researcher within the Global Research and Analysis Team, focusing on targeted attack research. He received his degree from the Cybernetics and Applied Mathematics facility of Moscow State University in 2002. His diploma topic was directly related to information security. He started his career as a programmer in various public and commercial companies. Before joining Kaspersky Lab in the beginning of 2014, he worked as a technical expert for one of the Russian system integrators. He has presented his research at RSA Conference, ATEA and MBLT Dev. @legezo
Links:
Similar Presentations: