Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

12/6/2018
04:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

An Adobe Flash zero-day was seen in the wild as part of an active campaign using the exploit in Microsoft Office documents. Adobe has since patched the vulnerability, CVE-2018-15982.

Gigamon's Applied Threat Research (ATR) team identified the active campaign, which uses malicious files to deliver the exploit. CVE-2018-15982 lets a Flash object execute code on a target machine and enables an attacker to gain command line access to the victim's system.

The document used in this campaign, "22.docx," was submitted by a Ukrainian IP address to VirusTotal. It appears to be an application for a Russian state healthcare clinic; the logo indicates it's a fake application for "Polyclinic No. 2," an adult outpatient clinic located in Moscow. Analysts compared the logo in the doc to the clinic's authentic logo.

The file contains seven pages of personal questions typical of an employment application, requesting the recipient's full name, birthdate, profession, company division, and level of skill.

"It's indicative of a targeted spear-phishing attack, presumably things the receiver would be familiar with," says Josh Carlson, vice president of threat research at Gigamon. The way the document is crafted suggests its recipients would recognize the clinic's name and logo. While this type of phishing lure appears to be highly targeted, ATR researchers point out the team has observed other similar spear-phishing attacks in which lures are unrelated to their recipients.

It's hard to tell for sure because ATR doesn't have specifics on the extent of this campaign or number of people affected. Carlson suggests this is either a highly targeted attack, in which the actor(s) has substantial knowledge of the victim's environment, or the actor is testing his tools.

A Closer Look at the Attack
The way this attack unfolds is simple: The document's header contains an Active X control, which renders when the file is opened and causes an exploitation of Flash within Office. The exploitation leads to the execution of a malicious command, which attempts to extract and execute a payload, researchers explain in a blog post on their discovery.

In this case, the Flash exploit is self-encapsulated within the document and supports 32- and 64-bit systems. The Flash file and shellcode stubs don't make use of remote inclusion, staging, obfuscation, or any kind of anti-analysis, researchers say. Both shellcode stubs execute the same command, which is consistent with an attack packaged as a RAR archive. Testing shows that opening the document within the archive is enough to run the exploit and payload.

There isn't much that's unique about this campaign, Carlson says, but what's strange is it requires targets to take several steps to open the document and execute the command.

"It's unusual in that they have a zero-day in Flash, but they're requesting users to go through extra clicks and follow steps to leverage it," he explains.

Analysts have moderate to high confidence the payload is a variant of Scout malware, based on similarity in submission details, behavior, close time proximity, and file name matching the one expected by the exploit. The payload, a Windows executable file, is protected with VMProtect, which prevents reverse engineering and analysis. The payload collects system data, establishes persistence, and communicates with a remote server via HTTP post.

The techniques of this campaign are similar to those used by HackingTeam, an Italian offensive security company selling remote access-as-a-service and surveillance tools. When HackingTeam was breached in 2015, its internal data, including email and source code for backdoors and exploits, was publicly spread. Cyberattackers around the world began using HackingTeam's tools to launch operations. This could be the case here, but attribution is difficult, ATR says.

"There are similarities to HackingTeam, but in reality those tools have been reused by many copycats," Carlson says.

Flash Stays Alive…. For Now
The death of Flash is a common topic in cybersecurity as efforts aim to remove Flash from Web browsers. Cybercriminals, however, will continue to use it. They're just finding new ways. Vectors like Microsoft Office can still load and execute Flash content, and exploits against zero-days that allow for command execution using popular enterprise software will prove valuable.

"As Flash is less used in browsers, the attackers are moving toward Office as an attack vector," Carlson explains. Flash is going to become less of an attack surface over time, but it still works, he says.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.