Jun. 21st, 2015

leo_sosnine: (Default)
Из отчёта Каспера о Duqu 2.0:

One of the payloads bundled together with “klif.dll” is called “CTwoPENC.dll”. This is aWindows kernel mode exploit (CVE-2015-2360) that allows them to run code with the highest privileges in the system We recovered several versions of “CTwoPENC.dll”, both for 32-bit and 64-bit versions of Windows, with the following compilation timestamps:
• 2014.08.25 01:20:04 (GMT) • 2014.08.25 01:19:03 (GMT) • 2014.07.06 09:17:03 (GMT)
Unlike other Duqu 2.0 modules, these timestamps appear to be legitimate. The reason for this remains unknown – perhaps the Duqu platform developers got this module from somebody else and forgot to patch its compilation timestamp.


Т.е., если верна оценка валидности таймстампов, Майкрософт в июне 2015 года пропатчил критический зиро-дей, эксплойт к которому был скомпилирован в июле-августе 2014.

Как страшно жыть!
Page generated Jun. 20th, 2025 01:38 am
Powered by Dreamwidth Studios