Cloud

6/21/2018
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Office: The Go-To Platform for Zero-Day Exploits

Malicious Office documents are the weapon of choice among cybercriminals, who use files to access remotely hosted malicious components.

Email is a common means of delivering cyberattacks, and Microsoft Office documents are commonly attached to malicious emails. More threat actors are using Word and Excel files to deliver zero-day exploits that are getting more dangerous and even harder to detect.

Researchers at Menlo Security dug further into the connection between Microsoft Office documents and cybercrime. They found attackers are increasingly using malicious Office docs for endpoint exploitation but instead of attaching files packed with malicious macros, they use Office docs to call remotely hosted malicious components, launching exploits in the browser.

Using Office documents in emailed cyberattacks is not new. Some companies send legitimate files with macros enabled; knowing this, threat actors began to use them as a means of infecting endpoints. Unfortunately for them, security tools have become more adept and users have become more security savvy. Fewer are clicking "enable macros" to launch attacks.

As a result, threat actors are shifting their strategies. They don't want the user to click anything for a malicious document to be exploited.

"There is a shift in the TTPs that the attackers are using," explains Vinay Pidathala, Menlo's director of security research. "In late 2017 and early 2018, pretty much all the zero-days getting exploited have used Word, and used remote malicious components to exploit the endpoint."

CVE-2017-0199: Where the Trouble Started

Several vulnerabilities have allowed these exploits to happen, Pidathala says. CVE-2017-0199, published in 2016, is one. The Microsoft Office/WordPad remote code execution vulnerability exploits a logic flaw in Microsoft Word. It appeared in the wild in 2016, when an attack used Word files containing an embedded object that fetched a remote resource from the Web.

This bug lets attackers run code on target systems using the Object Linking and Embedding (OLE) technology in Windows to deliver malware. Anyone who successfully exploited the flaw could control target systems, create new accounts, and view, edit, and delete data.

CVE-2017-0199 was "the start of it all," says Pidathala. Attackers could remotely host their malicious content online; by opening the doc, their target could fetch the resource and get it onto the endpoint without an application displaying any warnings about potential infection.

The trend of remotely hosting cyberthreats continued to grow. A more current example can be seen in CVE-2018-8174, a Windows VBScript Engine Remote Code Execution Vulnerability, which exploits the library used by Internet Explorer to render Web pages. The so-called "Double Kill" bug could let an attacker execute code with the current user's privileges.

An attack starts with a spearphishing email with a malicious RTF file attached. The document contains an OLE object; when activated, it downloads and renders an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page uses the exploit to download a payload to the endpoint.

It's worth noting Microsoft has patched both CVE-2017-0199 and CVE-2018-8174; however, both individuals and businesses may be behind on their patching and should be aware.

Why Office Documents?

Microsoft Office is an increasingly common platform to launch these attacks because many applications that were once exploited in the browser can also be accessed using a Word document, Pidathala explains.

With CVE-2018-8174, for example, attackers could have targeted a vulnerable version of IE directly without using Word as a conduit. However, links sent in malicious emails will open in IE if clicked, even if the target uses a different default browser. Attackers don't need to use Word either; they could leverage other Office document types to achieve the same goals.

Internet Explorer isn't the default browser on many Windows systems, he continues, especially with the arrival of Edge in Windows 10. However, by embedding an Internet Explorer zero-day and delivering it through Word, an attacker can hit targets who don't have IE set by default.

The reason we're seeing a rise in remotely hosted components is because most security systems differentiate "good" vs. "bad" content, researchers explain. A malicious document only containing a link won't trigger most sandboxes or antivirus solutions to block it.

"Most controls can't detect these kinds of things because of the blended nature of the threat," Pidathala continues. Businesses often allocate less resources toward prevention; typically, industry techniques focus on remediation after the infection has been detected.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.