Analytics

5/30/2018
03:21 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Windows 'Double Kill' Attack Code Found in RIG Exploit Kit

Microsoft issued a fix for the remote code execution zero-day vulnerability in May, but research shows businesses have slowed their patching processes post-Meltdown.

Researchers are warning businesses to be prepared for potential widespread attacks using the Double Kill exploit code that was posted online three days ago and has now been discovered incorporated into the RIG Exploit Kit and ThreadKit crimeware packages.

Double Kill is the moniker given by researchers to the recently patched CVE-2018-8174, a critical flaw affecting all versions of Windows. It's the more severe of two flaws that were under active attack when Microsoft issued fixes on Patch Tuesday earlier this month. Double Kill is a Windows VBScript Engine Remote Code Execution Vulnerability, independently discovered both by researchers at Kaspersky Lab and Chinese security firm Qihoo360 Core and reported to Microsoft.

The vulnerability exists in the way the VBScript engine handles objects in memory. If successfully exploited, it could enable attackers to execute code with the same privileges as the current user and reallocate memory, take steps toward gaining arbitrary read/write access, hijack execution flows, and potentially achieve code execution.

Active attacks abusing CVE-2018-8174 started as spear-phishing emails with malicious RTF documents attached. The docs contained an OLE object which, when activated, downloaded and rendered an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page leverages the exploit to download a payload to the machine.

While attacks in the wild used RTF documents, Microsoft explains that attackers could also dupe a victim into visiting a website designed to exploit the flaw through Internet Explorer, or embed an ActiveX control marked "safe for initialization" in an app or Office document that hosts the IE rendering engine.

Abusing OLE to load an IE exploit in Word in a new technique, explain researchers at Barkly. They fear attacks abusing this flaw are poised to increase, especially because it works whether or not the target machine runs IE as the default browser.

CVE-2018-8174 isn't the only Windows vulnerability being used in the wild. Microsoft also confirmed attackers were also actively exploiting CVE-2018-8120, a privilege escalation vulnerability that could allow attackers to gain control over a system, view or edit data, or create new accounts with full user rights.

Microsoft did not provide more info on how widely spread CVE-2018-8120 attacks have been in the wild. The working PoC exploit code is also available on GitHub; Barkly experts say "it's only a matter of time before more attacks take advantage of this vulnerability."

RIG, ThreadKit, and Potential for Abuse

On May 24, 2018, shortly after the PoC exploit code for CVE-2018-8174 was posted online, an attacker going by the name "TakeThat" was seen taking responsibility for implementing the flaw into the RIG Exploit Kit (RIG EK). TakeThat claimed the infection rate had increased.

RIG EK is among the most popular exploit kits to distribute malicious payloads. It's packed with a variety of threats, from ransomware and credential theft to Java and Flash exploits, explains Barkly CTO Jack Danahy. Cybercriminals taking advantage of the crypto craze have also recently leveraged RIG EK to distribute coin miner malware and collect digital currencies like Monero and Electroneum.

"The big value from the exploit kit is when people land on the system, it's likely there will be one exploit among many that will be useful to corrupt and infect the machine," he explains.

With the Double Kill exploit code being built into RIG EK, Danahy says it's more likely organizations that haven't patched CVE-2018-8174 will be vulnerable to exploits and whatever payloads attackers decide to deliver.

Its code has also been seen in ThreadKit, an exploit builder that can be used to create weaponized Office docs. It's accessible to cybercriminals with little technical expertise and the Double Kill exploit option can be purchased for $400 online. An exploit kit lures victims to a malicious site and infects them through the browser; this one lets attackers create weaponized documents that can be distributed however they want.

"It's a different kind of vector through which you can exercise the same functionality," says Danahy.

Patching Problems

Given the nature of this vulnerability, companies will want to ensure they have advanced protection. However, Barkly research discovered many have slowed down their patching processes after patches following Meltdown and Spectre caused problems earlier this year.

Research shows 80% of companies polled found the Meltdown and Spectre patching process to be unclear and 88% showed frustration with the process. Now, businesses are just as concerned about faulty updates as they are about Spectre. Two-thirds of respondents were worried about the lack of stable firmware updates leaving their company vulnerable to Spectre. However, they were just as concerned future patched would harm performance or stability.

Most IT pros (56%) said they had purposefully held back on applying updates and, in the future, will only do so after testing for compatibility and performance problems. Nearly one-quarter (23%) say they may not apply patches at all for fear of performance problems, and 75% say they are more likely to roll out patches more slowly in the future.

"If people are scared of patching Microsoft systems because of Spectre and Meltdown, they should realize how serious and pressing these attacks are," says Danahy, who advises organizations to rethink the slower approach to patching.

"The speed with which organizations are updating their systems means there's readily exploited vulnerabilities," he adds. "There's likely to be a lot of systems remaining vulnerable for a while."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4035
PUBLISHED: 2019-03-22
IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IBM X...
CVE-2019-4052
PUBLISHED: 2019-03-22
IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to discover login ids of registered users. IBM X-Force ID: 156544.
CVE-2019-9648
PUBLISHED: 2019-03-22
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a \..\..\ substring, allowing an attacker to enumerate file existence based on the returned information.
CVE-2019-9923
PUBLISHED: 2019-03-22
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CVE-2019-9924
PUBLISHED: 2019-03-22
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.