Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/21/2018
01:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Office: The Go-To Platform for Zero-Day Exploits

Malicious Office documents are the weapon of choice among cybercriminals, who use files to access remotely hosted malicious components.

Email is a common means of delivering cyberattacks, and Microsoft Office documents are commonly attached to malicious emails. More threat actors are using Word and Excel files to deliver zero-day exploits that are getting more dangerous and even harder to detect.

Researchers at Menlo Security dug further into the connection between Microsoft Office documents and cybercrime. They found attackers are increasingly using malicious Office docs for endpoint exploitation but instead of attaching files packed with malicious macros, they use Office docs to call remotely hosted malicious components, launching exploits in the browser.

Using Office documents in emailed cyberattacks is not new. Some companies send legitimate files with macros enabled; knowing this, threat actors began to use them as a means of infecting endpoints. Unfortunately for them, security tools have become more adept and users have become more security savvy. Fewer are clicking "enable macros" to launch attacks.

As a result, threat actors are shifting their strategies. They don't want the user to click anything for a malicious document to be exploited.

"There is a shift in the TTPs that the attackers are using," explains Vinay Pidathala, Menlo's director of security research. "In late 2017 and early 2018, pretty much all the zero-days getting exploited have used Word, and used remote malicious components to exploit the endpoint."

CVE-2017-0199: Where the Trouble Started

Several vulnerabilities have allowed these exploits to happen, Pidathala says. CVE-2017-0199, published in 2016, is one. The Microsoft Office/WordPad remote code execution vulnerability exploits a logic flaw in Microsoft Word. It appeared in the wild in 2016, when an attack used Word files containing an embedded object that fetched a remote resource from the Web.

This bug lets attackers run code on target systems using the Object Linking and Embedding (OLE) technology in Windows to deliver malware. Anyone who successfully exploited the flaw could control target systems, create new accounts, and view, edit, and delete data.

CVE-2017-0199 was "the start of it all," says Pidathala. Attackers could remotely host their malicious content online; by opening the doc, their target could fetch the resource and get it onto the endpoint without an application displaying any warnings about potential infection.

The trend of remotely hosting cyberthreats continued to grow. A more current example can be seen in CVE-2018-8174, a Windows VBScript Engine Remote Code Execution Vulnerability, which exploits the library used by Internet Explorer to render Web pages. The so-called "Double Kill" bug could let an attacker execute code with the current user's privileges.

An attack starts with a spearphishing email with a malicious RTF file attached. The document contains an OLE object; when activated, it downloads and renders an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page uses the exploit to download a payload to the endpoint.

It's worth noting Microsoft has patched both CVE-2017-0199 and CVE-2018-8174; however, both individuals and businesses may be behind on their patching and should be aware.

Why Office Documents?

Microsoft Office is an increasingly common platform to launch these attacks because many applications that were once exploited in the browser can also be accessed using a Word document, Pidathala explains.

With CVE-2018-8174, for example, attackers could have targeted a vulnerable version of IE directly without using Word as a conduit. However, links sent in malicious emails will open in IE if clicked, even if the target uses a different default browser. Attackers don't need to use Word either; they could leverage other Office document types to achieve the same goals.

Internet Explorer isn't the default browser on many Windows systems, he continues, especially with the arrival of Edge in Windows 10. However, by embedding an Internet Explorer zero-day and delivering it through Word, an attacker can hit targets who don't have IE set by default.

The reason we're seeing a rise in remotely hosted components is because most security systems differentiate "good" vs. "bad" content, researchers explain. A malicious document only containing a link won't trigger most sandboxes or antivirus solutions to block it.

"Most controls can't detect these kinds of things because of the blended nature of the threat," Pidathala continues. Businesses often allocate less resources toward prevention; typically, industry techniques focus on remediation after the infection has been detected.

Related Content:

Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go here for more information on this free event.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1817
PUBLISHED: 2019-11-20
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.
CVE-2013-2091
PUBLISHED: 2019-11-20
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CVE-2012-1257
PUBLISHED: 2019-11-20
Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor.
CVE-2013-1816
PUBLISHED: 2019-11-20
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.
CVE-2011-4455
PUBLISHED: 2019-11-20
Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php, (2) tiki-pagehistory.php, (3) tiki-removepage.php, or (4) tiki-rename_page.php.