Nytro Posted January 18, 2013 Report Posted January 18, 2013 Cve-2011-3402 Technical Analysis Description: CVE-2011-3402 is well known as the Windows Kernel TrueType 0-day used in the Duqu attack(s). Recently this exploit has begun to appear in several crimeware exploit kits... Actually, not merely just the exploit, but the entire font file used by Duqu, now being harnessed to infect a large population with malware. This talk will mostly be an extremely low-level walk-through of the font program within this TrueType font, which is used to manipulate the Windows Kernel into executing the native x86 shellcode. Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying. Original Source: Sursa: Cve-2011-3402 Technical Analysis Quote
