Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:21 PM
Connect Directly

Windows 'Double Kill' Attack Code Found in RIG Exploit Kit

Microsoft issued a fix for the remote code execution zero-day vulnerability in May, but research shows businesses have slowed their patching processes post-Meltdown.

Researchers are warning businesses to be prepared for potential widespread attacks using the Double Kill exploit code that was posted online three days ago and has now been discovered incorporated into the RIG Exploit Kit and ThreadKit crimeware packages.

Double Kill is the moniker given by researchers to the recently patched CVE-2018-8174, a critical flaw affecting all versions of Windows. It's the more severe of two flaws that were under active attack when Microsoft issued fixes on Patch Tuesday earlier this month. Double Kill is a Windows VBScript Engine Remote Code Execution Vulnerability, independently discovered both by researchers at Kaspersky Lab and Chinese security firm Qihoo360 Core and reported to Microsoft.

The vulnerability exists in the way the VBScript engine handles objects in memory. If successfully exploited, it could enable attackers to execute code with the same privileges as the current user and reallocate memory, take steps toward gaining arbitrary read/write access, hijack execution flows, and potentially achieve code execution.

Active attacks abusing CVE-2018-8174 started as spear-phishing emails with malicious RTF documents attached. The docs contained an OLE object which, when activated, downloaded and rendered an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page leverages the exploit to download a payload to the machine.

While attacks in the wild used RTF documents, Microsoft explains that attackers could also dupe a victim into visiting a website designed to exploit the flaw through Internet Explorer, or embed an ActiveX control marked "safe for initialization" in an app or Office document that hosts the IE rendering engine.

Abusing OLE to load an IE exploit in Word in a new technique, explain researchers at Barkly. They fear attacks abusing this flaw are poised to increase, especially because it works whether or not the target machine runs IE as the default browser.

CVE-2018-8174 isn't the only Windows vulnerability being used in the wild. Microsoft also confirmed attackers were also actively exploiting CVE-2018-8120, a privilege escalation vulnerability that could allow attackers to gain control over a system, view or edit data, or create new accounts with full user rights.

Microsoft did not provide more info on how widely spread CVE-2018-8120 attacks have been in the wild. The working PoC exploit code is also available on GitHub; Barkly experts say "it's only a matter of time before more attacks take advantage of this vulnerability."

RIG, ThreadKit, and Potential for Abuse

On May 24, 2018, shortly after the PoC exploit code for CVE-2018-8174 was posted online, an attacker going by the name "TakeThat" was seen taking responsibility for implementing the flaw into the RIG Exploit Kit (RIG EK). TakeThat claimed the infection rate had increased.

RIG EK is among the most popular exploit kits to distribute malicious payloads. It's packed with a variety of threats, from ransomware and credential theft to Java and Flash exploits, explains Barkly CTO Jack Danahy. Cybercriminals taking advantage of the crypto craze have also recently leveraged RIG EK to distribute coin miner malware and collect digital currencies like Monero and Electroneum.

"The big value from the exploit kit is when people land on the system, it's likely there will be one exploit among many that will be useful to corrupt and infect the machine," he explains.

With the Double Kill exploit code being built into RIG EK, Danahy says it's more likely organizations that haven't patched CVE-2018-8174 will be vulnerable to exploits and whatever payloads attackers decide to deliver.

Its code has also been seen in ThreadKit, an exploit builder that can be used to create weaponized Office docs. It's accessible to cybercriminals with little technical expertise and the Double Kill exploit option can be purchased for $400 online. An exploit kit lures victims to a malicious site and infects them through the browser; this one lets attackers create weaponized documents that can be distributed however they want.

"It's a different kind of vector through which you can exercise the same functionality," says Danahy.

Patching Problems

Given the nature of this vulnerability, companies will want to ensure they have advanced protection. However, Barkly research discovered many have slowed down their patching processes after patches following Meltdown and Spectre caused problems earlier this year.

Research shows 80% of companies polled found the Meltdown and Spectre patching process to be unclear and 88% showed frustration with the process. Now, businesses are just as concerned about faulty updates as they are about Spectre. Two-thirds of respondents were worried about the lack of stable firmware updates leaving their company vulnerable to Spectre. However, they were just as concerned future patched would harm performance or stability.

Most IT pros (56%) said they had purposefully held back on applying updates and, in the future, will only do so after testing for compatibility and performance problems. Nearly one-quarter (23%) say they may not apply patches at all for fear of performance problems, and 75% say they are more likely to roll out patches more slowly in the future.

"If people are scared of patching Microsoft systems because of Spectre and Meltdown, they should realize how serious and pressing these attacks are," says Danahy, who advises organizations to rethink the slower approach to patching.

"The speed with which organizations are updating their systems means there's readily exploited vulnerabilities," he adds. "There's likely to be a lot of systems remaining vulnerable for a while."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-11
FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
PUBLISHED: 2020-08-10
An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
PUBLISHED: 2020-08-10
A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.