A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.

Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.

Deployed rapidly, widely shared

The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.

Read full article

Comments

If you’ve installed Chromium or Google Chrome as a Flatpak, you’ve installed an unofficial, community-maintained package done independently of the search giant – that could be about to change. Chromium’s build system is now able to generate Flatpak packages of the browser itself, though its developers caution that the change does not mean official Flatpak support is coming. A commit made by Google’s Tom Anderson this week adds the necessary packaging scripts and a build flag (enable_flatpak) to produce a .flatpak package rather than a .deb or .rpm, but that flag is off by default (for now). If enabled, Google’s […]

You're reading Chrome moves a step closer to an official Flatpak, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

If you’ve installed Chromium or Google Chrome as a Flatpak, you’ve installed an unofficial, community-maintained package done independently of the search giant – that could be about to change. Chromium’s build system is now able to generate Flatpak packages of the browser itself, though its developers caution that the change does not mean official Flatpak support is coming. A commit made by Google’s Tom Anderson this week adds the necessary packaging scripts and a build flag (enable_flatpak) to produce a .flatpak package rather than a .deb or .rpm, but that flag is off by default (for now). If enabled, Google’s […]

You're reading Chrome moves a step closer to an official Flatpak, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

Chinese retailer AliExpress has been caught fingerprinting visitors after one of the metrics—an outdated technique that measures inaudible sounds it sends to browsers—impeded a researcher's ability to use his bluetooth headphones.

Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time. He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.

Users can't hear it, but browsers can

While investigating the odd behavior, Callaghan said he found two highly obfuscated scripts. Together, they rendered a graph that analyzed the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in output from digital audio.

Read full article

Comments