{"uuid": "30c8d4db-dc6e-4ce5-a114-6ecd8a14cf06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-1151", "type": "seen", "source": "https://t.me/hacking_Attack/9319", "content": "Black Hat Ethical Hacking\nMicrosoft, Adobe Exploits Top List of Crooks\u2019 Wish List\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft, Adobe Exploits Top List of Crooks\u2019 Wish ListPost Views: 35 \nReading Time: 2 Minutes\nA year-long study into the underground market for exploits in cybercriminal forums shows that crooks are salivating for Microsoft bugs, which are far and away the most requested and most sold exploits.\nAccording to researchers (see chart below) Microsoft products made up a whopping 47 percent of the requests, compared with, say, internet of things (IoT) exploits, which only accounted for 5 percent.\n\nThe exploit market is accommodating cybercrooks\u2019 hunger for puncturing Microsoft products, according to Trend Micro. A second data point (see chart below) shows that 61 percent of sold exploits targeted Microsoft products, including Office, Windows, Internet Explorer and Microsoft Remote Desktop Protocol (RDP).\n\nNo surprise there. Flashpoint researchers also reported in December, prices for RDP server access has been surging.\n\nThe research was presented on Monday at the all-virtual RSA Conference 2021, by Trend Micro Senior Researcher Mayra Rosario Fuentes. In her session, titled Tales from the Underground: The Vulnerability Weaponization Lifecycle, Fuentes said that the study tracked the exploits that were sold and requested on more than 600 underground forums over a year. https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/17225827/Sold-Market-300x245.png What gets sold on the exploits market.\u00a0 Source: Trend Micro\nResearchers found that the average price for exploits that threat actors were willing to pay was $2,000. The crooks are going after fresh, tender new vulnerabilities, with 52 percent of exploits on their wish list being less than 2 years old: an age bracket that also accounts for 54 percent of exploits being sold. https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/17225807/Most-Requested-Exploits-300x203.png Most-requested exploits. Source: Trend Micro See Also: Bizarro Banking Trojan Sports Sophisticated Backdoor Oldies But Goodies Are Still Hot-Hot-HotOlder vulnerabilities are still in demand, though: 22 percent of the exploits sold in the underground were 3+ years old, according to Fuentes. The oldest vulnerability was downright arthritic, dating back to 1999.\n\nOf the \u201coutdated\u201d exploits being sold, 45 percent were Microsoft-flavored, with the second crook crowd-pleaser being Adobe exploits. Fuentes pointed out that the average time to patch an internet-facing system is 71 days: a whole lot of time for attackers to do some damage. https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/17225814/Outdated-Exploits-Sold-300x244.png Outdated exploits being sold on underground forums. Source: Trend Micro \nYou can see one example of an exploit request below, where the potential purchaser was looking for an exploit of CVE-2019-1151\u00a0\u2013 a remote code execution (RCE) of a Microsoft Graphics vulnerability.\n\nAnother request, posted on Dec. 23, 2020, was looking for \u201ca potential 1-day RCE vulnerability\u201d in Apache Web Server: not a surprising find, given that the RiskSense Spotlight Report found that the WordPress and Apache Struts web frameworks were the most-targeted by cybercriminals in 2019.\nSee Also: Offensive Security Tool: EyeWitness Trend Micro researchers found that Office and Adobe exploits were most common in English-speaking forums. As of last week, Adobe Acrobat, the world\u2019s leading PDF reader, was under active attack\u00a0after a vulnerability that could lead to RCE was exploited. That one affected both Windows \u2013 one of attackers\u2019 pre[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.277672Z"}