Threat Intelligence

12/6/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victim's system.

The document used in this campaign, "22.docx," was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates it's a fake application for "Polyclinic No. 2," an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinic's authentic logo.

The file contains seven pages of personal questions typical of an employment application, requesting the recipient's full name, birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with," says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinic's name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.

It's hard to tell for sure because ATR doesn't have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victim's environment, or the actor is testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a blog post on their discovery.

In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs don't make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.

(Image: Kaspars Grinvalds - stock.adobe.com)

(Image: Kaspars Grinvalds stock.adobe.com)

There isn't much that's unique about this campaign, Carlson says, but what's strange is it requires targets to take several steps to open the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're requesting users to go through extra clicks and follow steps to leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeam's tools to launch operations. This could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools have been reused by many copycats," Carlson says.

Flash Stays Alive…. For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. They're just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward Office as an attack vector," Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.