Threat Intelligence

12/6/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victim's system.

The document used in this campaign, "22.docx," was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates it's a fake application for "Polyclinic No. 2," an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinic's authentic logo.

The file contains seven pages of personal questions typical of an employment application, requesting the recipient's full name, birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with," says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinic's name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.

It's hard to tell for sure because ATR doesn't have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victim's environment, or the actor is testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a blog post on their discovery.

In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs don't make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.

(Image: Kaspars Grinvalds - stock.adobe.com)

(Image: Kaspars Grinvalds stock.adobe.com)

There isn't much that's unique about this campaign, Carlson says, but what's strange is it requires targets to take several steps to open the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're requesting users to go through extra clicks and follow steps to leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeam's tools to launch operations. This could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools have been reused by many copycats," Carlson says.

Flash Stays Alive…. For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. They're just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward Office as an attack vector," Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7715
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf(). Setting this variable using the sysvar command results in a user-c...
CVE-2019-8981
PUBLISHED: 2019-03-26
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged.
CVE-2019-10061
PUBLISHED: 2019-03-26
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
CVE-2019-7711
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addre...
CVE-2019-7712
PUBLISHED: 2019-03-26
An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() without a proper check. An attacker may thus forge a path contain...