Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/16/2017
03:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Old Flaws, New Tricks: CVE-2017-0199 and PowerPoint Abuse

Researchers discover attackers are using a patched Microsoft vulnerability to abuse PowerPoint files and distribute malware.

Attackers are using an old vulnerability to distribute malware in a new way. Microsoft PowerPoint files are being used as more effective means of delivering payloads.

CVE-2017-0199, originally a zero-day remote code execution vulnerability, lets attackers run code on target systems using the Object Linking and Embedding (OLE) technology in Windows to deliver malware. It was previously exploited using malicious Rich Text File (RTF) documents, the same technique seen in the DRIDEX banking Trojan.

Attackers who successfully exploited the vulnerability could assume control over target systems and create new accounts with full user rights, install programs, and view, edit, or delete data. Researchers at TrendMicro have found malware exploiting the same flaw but using PowerPoint files for distribution, a technique not previously seen in the wild.

"Attackers are using the PowerPoint Show (PPSX) format -- a slide presentation that starts showing automatically -- in order to reduce the chances that the victim sees anything amiss with the slides," says Mark Nunnikhoven, VP of cloud security at Trend Micro.

PPSX files are designed for PowerPoint viewers, not authors, he continues. While the malicious file is still a full document, the intention is different and most users will automatically execute the presentation. Using PPSX files streamlines payload delivery to a single click.

The initial exploit arrives as a spearphishing email disguised as a message from a cable manufacturing provider. Nunnikhoven explains these attacks have initially targeted electronic manufacturers but this likely has little to do with that specific industry.

"It's not uncommon for new techniques to target specific verticals first," he says. "This speaks more to the attackers' motivations than any particular issue with that vertical."

The emails contain a malicious PPSX attachment, which downloads a file called logo.doc from the C&C server. This runs a PowerShell command to download and execute a file called RATMAN.EXE, a trojanized version of the REMCOS remote access tool (RAT).

Attackers can use the customizable REMCOS RAT to run remote commands and control a system from anywhere in the world. Its capabilities include a download and execute command, keylogger, screen logger, and webcam and microphone recorders.

The trojanized sample discovered by Trend Micro uses an unknown .NET protector, which contains obfuscations that make it difficult to reverse. Since most detection methods for CVE-2017-0199 focuses on RTF, the use of PPSX files allows attackers to evade antivirus detection.

Microsoft issued a patch for CVE-2017-0199 in April that will prevent this method of exploitation. PPSX is simply a more effective means of attacking victims. However, Nunnikhoven acknowledges the reality that systems may have been left unpatched and remain exposed. Legacy systems and business challenges "provide attackers with a lengthy window" to exploit vulnerabilities.

In some cases, there is no patch at all. This vulnerability affects Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016. It also affects Windows Vista SP2, Server 2008 SP2, 7 SP1, and 8.1.

"Some of these systems are end of life supporting, which means without an explicit support agreement with Microsoft a patch is unavailable," he continues. "For other systems, the challenges in patching all systems in a timely manner leave organizations at risk."

Legacy systems are "a weak link in the chain," says Nunnikhoven, and attackers can use them to gain footholds into networks where they can find more modern systems to hit. Attackers are continuing to "actively exploit" older systems, he emphasizes, and it's critical for businesses to invest in IT infrastructure.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4128
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the ID Vault service.
CVE-2020-7335
PUBLISHED: 2020-12-01
Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploit...
CVE-2020-15257
PUBLISHED: 2020-12-01
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that...
CVE-2020-9114
PUBLISHED: 2020-12-01
FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause pr...
CVE-2020-9117
PUBLISHED: 2020-12-01
HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-bounds read and write vulnerability. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected prod...