A threat actor exploited 11 zero-day flaws in 2020 campaigns

A hacking group has employed at least 11 zero-day flaws as part of an operation that took place in 2020 and targeted Android, iOS, and Windows users.

Google’s Project Zero security team published a report about the activity of a mysterious hacking group that operated over the course of 2020 and exploited at least 11 zero-day vulnerabilities in its attacks on Android, iOS, and Windows users.

Google researchers observed two separate waves of attacks that took place in February and October 2020, respectively. Threat actors set up malicious sites in a series of watering hole attacks that were redirecting visitors to exploit servers hosting exploit chains for Android, Windows, and iOS devices.

“In October 2020, Google Project Zero discovered seven 0-day exploits being actively used in-the-wild. These exploits were delivered via “watering hole” attacks in a handful of websites pointing to two exploit servers that hosted exploit chains for Android, Windows, and iOS devices.” wrote the popular Project Zero researcher Maddie Stone. “These attacks appear to be the next iteration of the campaign discovered in February 2020 and documented in this blog post series.”

In Oct 2020, we discovered seven 0-day exploits in-the-wild from two exploit servers. The exploit chains targeted Android, Windows, and iOS devices.Each step we take towards making 0-day hard, makes all of us safer.https://t.co/YLosCIuevf— Maddie Stone (@maddiestone) March 18, 2021Since February 2020, the same hacking group set up at least a couple dozen websites in its attacks, experts noticed that the threat actors relied on both zero-day vulnerabilities and known flaws.

Nonetheless, the threat actor behind the attacks also showed the ability to replace zero-days on the fly once one was detected and patched by software vendors.

Below the exploits that were delivered based on the device and browser in the last wave of attacks:

Exploit ServerPlatformBrowserRenderer RCESandbox EscapeLocal Privilege Escalation1iOSSafariStack R/W via Type 1 Fonts (CVE-2020-27930)Not neededInfo leak via mach message trailers (CVE-2020-27950)Type confusion with turnstiles (CVE-2020-27932)1WindowsChromeFreetype heap buffer overflow(CVE-2020-15999)Not neededcng.sys heap buffer overflow (CVE-2020-17087)1Android** Note: This was only delivered after #2 went down and CVE-2020-15999 was patched.ChromeV8 type confusion in TurboFan (CVE-2020-16009)UnknownUnknown2AndroidChromeFreetype heap buffer overflow(CVE-2020-15999)Chrome for Android head buffer overflow (CVE-2020-16010)Unknown2AndroidSamsung BrowserFreetype heap buffer overflow(CVE-2020-15999)Chromium n-dayUnknownBelow the list of zero-day flaws exploited in the February 2020 campaign:

CVE-2020-6418 – Chrome Vulnerability in TurboFanCVE-2020-0938 – Font Vulnerability on WindowsCVE-2020-1020 – Font Vulnerability on WindowsCVE-2020-1027 – Windows CSRSS Vulnerabilitywhile the zero-day flaws exploited in the October 2020 attacks are:

CVE-2020-15999 – Chrome Freetype heap buffer overflowCVE-2020-17087 – Windows heap buffer overflow in cng.sysCVE-2020-16009 – Chrome type confusion in TurboFan map deprecationCVE-2020-16010 – Chrome for Android heap buffer overflowCVE-2020-27930 – Safari arbitrary stack read/write via Type 1 fontsCVE-2020-27950 – iOS XNU kernel memory disclosure in mach message trailersCVE-2020-27932 – iOS kernel type confusion with turnstilesAt the time of this writing, Google has yet to attribute these campaigns to any specific threat actor and it is still unclear if the attacks have been conducted by a nation-state actor.

“The vulnerabilities cover a fairly broad spectrum of issues – from a modern JIT vulnerability to a large cache of font bugs. Overall each of the exploits themselves showed an expert understanding of exploit development and the vulnerability being exploited. In the case of the Chrome Freetype 0-day, the exploitation method was novel to Project Zero.” concludes the post. “Project Zero closed out 2020 with lots of long days analyzing lots of 0-day exploit chains and seven 0-day exploits. When combined with their earlier 2020 operation, the actor used at least 11 0-days in less than a year.”

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, zero-day)

The post A threat actor exploited 11 zero-day flaws in 2020 campaigns appeared first on Security Affairs.