Candiru spyware exploited Chrome 0-day flaw to attack journalists

Do Son July 22, 2022 2 minutes read

On July 4, 2022, the Google Chrome stable channel was updated to version 103.0.5060.114. The vulnerabilities fixed by this update include CVE-2022-2294. In the changelog, Google mentioned that the company is aware of a vulnerability exploited by hackers in the wild, and this vulnerability refers to a WebRTC buffer overflow.

The vulnerability was submitted by researchers from the Avast Threat Intelligence team, who had already discovered that the vulnerability was being exploited by Israeli spyware developers. The spyware developer, Candiru, helps its clients launch attacks against users in Lebanon, Turkey, Yemen, and Palestine.

Unlike regular vulnerabilities that require users to click a specific link or install specific software, the vulnerability exploited by Candiru spyware does not require user interaction. Its malicious code can be embedded in well-known websites such as news websites through other attack methods, and victims will be infected immediately whenever they visit these websites.

Affected browsers include but are not limited to Google Chrome, in fact, any browser based on the Chromium kernel will exist this vulnerability. In one case, attackers compromised a Lebanese news organization to enable JavaScript snippets used in XSS cross-site scripting attacks on its website. When the victim visits the website, the attacker will call 50 data points to analyze it, and if it is determined to be the target user, it will use the vulnerability to establish a data exchange. “The collected information includes the victim’s language, timezone, screen information, device type, browser plugins, referrer, device memory, cookie functionality, and more,” explains Avast’s report.

Since the vulnerability is in WebRTC, it also affects Apple’s Safari browser, but the vulnerability discovered by Avast only applies to Windows systems.

For users, no one knows when and what vulnerabilities will be discovered, but the only thing that can be done is to update browsers and other software in a timely manner to block the vulnerabilities. The vulnerability mentioned above was discovered and exploited as early as March, and the actual exploit time should have been earlier, and Avast could not find the earliest exploit event. After the vulnerability report, Google quickly released a new version to fix it, Microsoft followed up the next day, and Apple released a patch to fix the Safari browser on July 20. At present, most browsers have been upgraded, and at least the exploitation of this vulnerability has failed.

Support Our Threat Intelligence

Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Tags: Candiru spyware CVE-2022-2294

Support Our Threat Intelligence

Get Zero-Hour Vulnerability Alerts

Do Son