Russian cyber attackers used two unknown flaws

A widely reported Russian cyber-spying campaign against diplomatic targets in the United States and elsewhere has been using two previously unknown flaws in software to penetrate target machines, a security company investigating the matter said on Saturday. FireEye Inc, a prominent U.S. security company, said the espionage effort took advantage of holes in Adobe Systems Inc’s Flash software for viewing active content and Microsoft Corp’s ubiquitous Windows operating system. The campaign has been tied by other firms to a serious breach at U.S. State Department computers. The same hacking group, named APT28 by FireEye - are also believed to have broken into White House machines containing unclassified but sensitive information such as the president’s travel schedule. FireEye has been assisting the agencies probing those attacks, but it said it could not comment on whether the spies are the same ones who penetrated the White House because that would be classified as secret. FireEye said that Adobe had issued a fix for the security weakness on Tuesday, so that users with the most current versions should be protected. The Microsoft problem by itself is less dangerous, since it involves enhanced powers on a computer from those of an ordinary user. Though the security flaws APT28 used are new, it had been well established that the group was highly skilled.

Technology fireeye