In-the-Wild Series: October 2020 0-day discovery

Summary: In October 2020, Google Project Zero discovered seven 0-day exploits being actively used in-the-wild, delivered via watering hole attacks on a couple dozen websites that redirected to two exploit servers hosting chains for Android, Windows, and iOS. The actor behind the campaign, which Project Zero links to a February 2020 operation, used at least 11 0-days in less than a year when both campaigns are combined.
Key Takeaway: Two distinct operators ran separate exploit servers that both used the Chrome Freetype RCE (CVE-2020-15999) as a renderer exploit, and the iOS exploits were encrypted with ephemeral keys so they could not be recovered from a packet dump alone. A single actor fielding at least 11 0-days in under a year, with per-platform obfuscation and anti-analysis checks, sets the bar your detection and patch cadence are measured against.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-15999 CVE-2020-16009 CVE-2020-16010 CVE-2020-17087 CVE-2020-27930 CVE-2020-27932 CVE-2020-27950
Related: Patch Tuesday, November 2020 Edition Cyber Risks ·
CVE-2020-17087: Microsoft Windows Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
CVE-2020-16009: Google Chromium V8 Type Confusion Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021