Jump to content

Google discloses hacking campaign targeting Windows, Android users


Recommended Posts

Google discloses hacking campaign targeting Windows, Android users

 

Google-Project-Zero.jpg

 

Project Zero, Google's 0day bug-hunting team, revealed a hacking campaign coordinated by "a highly sophisticated actor" and targeting Windows and Android users with zero-day and n-day exploits.

 

The Project Zero team, in collaboration with the Google Threat Analysis Group (TAG), discovered a watering hole attack using two exploit servers in early 2020, each of them using separate exploit chains to compromise potential targets.

"These exploit chains are designed for efficiency & flexibility through their modularity," Project Zero said after analyzing them for several months.

"They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks. We believe that teams of experts have designed and developed these exploit chains."

 

Project Zero researchers were able to collect a trove of information from the two exploit servers including:

  • Renderer exploits for four bugs in Chrome, one of which was still a 0-day at the time of the discovery.
  • Two sandbox escape exploits abusing three 0-day vulnerabilities in Windows.
  • A “privilege escalation kit” composed of publicly known n-day exploits for older versions of Android.

 

One of the exploit server used in those hacking operation was used to target Windows users, while the other specifically attempt to compromise Android devices.

 

In both cases, the attackers made use of Chrome exploits to remotely execute malicious code on the targets' devices remote code execution, zero-days for Windows devices, and n-day ones for Android.

 

While no Android zero-days were used in the Android exploit chain, "[b]ased on the actor's sophistication, we think it's likely that they had access to Android 0-days, but we didn't discover any in our analysis," Project Zero said.

 

Windows-Android-hacking.jpg

Hacking campaign targeting Windows and Android devices (Google)

 

"Exploitation aside, the modularity of payloads, interchangeable exploitation chains, logging, targeting and maturity of this actor's operation set these apart," Project Zero added.

 

"We hope that by sharing this information publicly, we are continuing to close the knowledge gap between private exploitation (what well resourced exploitation teams are doing in the real world) and what is publicly known."

 

The four zero-days exploited in these attacks and patched last year are:

  • CVE-2020-6418 - Chrome Vulnerability in TurboFan (fixed February 2020)
  • CVE-2020-0938 - Font Vulnerability on Windows (fixed April 2020)
  • CVE-2020-1020 - Font Vulnerability on Windows (fixed April 2020)
  • CVE-2020-1027 - Windows CSRSS Vulnerability (fixed April 2020)

 

All three Windows zero-days were addressed by Microsoft in the April 2020 Patch Tuesday, while the Chrome zero-day was patched by Google in February 2020 with the release of Chrome 80.0.3987.122 after discovering an exploit in the wild.

 

The Project Zero team also published separate reports about the Chrome "Infinity Bug" used to target Android users, the ChromeAndroid, and Windows exploit chains, as well as the post-exploitation procedure used on rooted and compromised Android devices, as observed in the attacks.

 

 

Source: Google discloses hacking campaign targeting Windows, Android users

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...