Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

12/6/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victim's system.

The document used in this campaign, "22.docx," was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates it's a fake application for "Polyclinic No. 2," an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinic's authentic logo.

The file contains seven pages of personal questions typical of an employment application, requesting the recipient's full name, birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with," says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinic's name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.

It's hard to tell for sure because ATR doesn't have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victim's environment, or the actor is testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a blog post on their discovery.

In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs don't make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.

(Image: Kaspars Grinvalds - stock.adobe.com)

(Image: Kaspars Grinvalds stock.adobe.com)

There isn't much that's unique about this campaign, Carlson says, but what's strange is it requires targets to take several steps to open the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're requesting users to go through extra clicks and follow steps to leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeam's tools to launch operations. This could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools have been reused by many copycats," Carlson says.

Flash Stays Alive…. For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. They're just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward Office as an attack vector," Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23347
PUBLISHED: 2021-03-03
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user.
CVE-2021-25315
PUBLISHED: 2021-03-03
A Incorrect Implementation of Authentication Algorithm vulnerability in of SUSE SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE SUSE Linux Enterprise Server 15 ...
CVE-2021-27921
PUBLISHED: 2021-03-03
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
CVE-2021-27922
PUBLISHED: 2021-03-03
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
CVE-2021-27923
PUBLISHED: 2021-03-03
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.