Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:05 PM
Connect Directly

Attacks On Patched Sandworm Flaw Force Microsoft To Issue Fix It

More than a week after Microsoft fixed a flaw affecting almost all Windows versions, attackers are continuing to exploit it.

Attackers have managed to bypass a security patch that Microsoft issued last week to address the recently discovered Sandworm vulnerability in Windows, prompting the company to issue another advisory this week, warning users of the new threat.

All supported versions of Windows, except Windows server 2003, continue to be vulnerable to attacks that attempt to exploit the vulnerability through rogue PowerPoint attachments, Microsoft noted earlier this week.

“An attacker who successfully exploited the vulnerability could gain the same user rights as the current user,” Microsoft warned. The company issued a temporary Fix It patch for mitigating exposure to the threat and encouraged users to apply it immediately.

The Sandworm vulnerability refers to a Windows packager zero-day flaw that basically gives attackers a way to take complete remote control of an infected system. Attackers typically have exploited the flaw using malicious PowerPoint files sent as innocuous attachments to unsuspecting users. When an infected PowerPoint file is opened, it drops a malicious payload on the system.

Russian cyber espionage gang Sandworm has used the exploit in numerous attacks against NATO, the Ukrainian government, and various targets in the US since 2013.

Microsoft last week issued a patch (MS14-060) to address the flaw, which exists in the Object Linking and Embedding (OLE) code within Windows.

However, several security vendors have reported seeing continued attacks seeking to exploit the same vulnerability in the days since Microsoft issued the patch.

In a blog post, Symantec said it has seen at least two groups of attackers that are continuing to take advantage of the Sandworm flaw by using an exploit that deftly sidesteps the Microsoft patch.

As with previous exploits, attackers are still using malicious PowerPoint documents to try and trick users into downloading malware on their systems, Symantec noted.

The new attacks are being used to deliver at least two different malicious payloads to victims. Symantec identified one of the payloads as Trojan.Taidoor and the other as Backdoor.Darkmoon or Poison Ivy.

The group using Taidoor has been around since at least 2008 and has a track record of exploiting new zero-day flaws, Symantec said. The Darkmoon variant, meanwhile, appears to have been ready for use several weeks before Microsoft disclosed the Sandworm vulnerability last week, Symantec added.

According to Trend Micro, with the new exploits, attackers are embedding the malicious files directly in the OLE object. So when a user opens an infected PowerPoint file, the malware is dropped directly on the system, instead of from a remote location.

“One advantage of this approach is that it will not require the computer to connect to the download location, thus preventing any detection from the Network Intrusion Prevention System (NIPS),” Trend Micro threat analyst Ronnie Giagone wrote on Trend Micro’s Security Intelligence blog.

McAfee security researcher Haifei Li said that Microsoft’s original patch for the Sandworm vulnerability might not have been “robust enough” to stop attackers from exploiting it. “In other words, attackers might still be able to exploit the vulnerability even after the patch is applied. Users who have installed the official patch are still at risk,” Li wrote on McAfee’s blog.

Users who are concerned about the threat should apply the Microsoft Fix It from this week’s advisory or apply the workarounds contained in the original MS14-060 bulletin from last week, Li said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-12-01
Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploit...
PUBLISHED: 2020-12-01
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that...
PUBLISHED: 2020-12-01
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause pr...
PUBLISHED: 2020-12-01
HUAWEI nova 4 versions earlier than and SydneyM-AL00 versions earlier than have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected prod...
PUBLISHED: 2020-12-01
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.