Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/9/2018
12:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

RTF Design, Office Flaw Exploited in Multi-Stage Document Attack

Threat actors chained CVE-2017-8570 with known design behaviors in .docx and RTF to launch a multi-stage document attack.

A newly discovered multi-stage document attack exploits design behaviors in .docx and RTF, along with CVE-2017-8570, to drop a malicious payload called Formbook on target endpoints. Attackers bypass traditional security tools with embedded URLs instead of active code.

Researchers at Menlo Security Labs who isolated the second-stage document say the behaviors enabling this attack are not new, but that this threat demonstrates an increasingly common way for hackers to slip past security defenses by relying on remotely hosted malicious objects.

"What we discovered is a new way in which Windows is getting the second-stage payload," says Vinay Pidathala, Menlo's director of security research. "There's absolutely no macros, no shellcode being used, just a URL. When the victim opens the document, it will go and fetch the remotely hosted components and load it in the context of the Word process."

The first stage of this attack is a phishing email with a malicious .docx file attached. The file does not have any macros, nor does it use any exploits, and embedded in its frame section is the URL. If the doc is opened, Word makes an HTTP request to download the remote object the URL is pointing to, which in this case redirects to another URL that points to a malicious RTF file.

Attackers are abusing capabilities in Microsoft Word that were more commonly used when it was an HTML editor, says Pidathala. Nobody uses Word to edit HTML anymore, he says, but those functions and API calls still exist and threat actors are taking advantage of them.

The RTF file contains an embedded script and another exploit, he continues. It marks stage two of the attack, which abuses both a design behavior in RTF documents and the CVE-2017-8570 vulnerability. When an RTF document with an embedded objected is opened, the object is automatically dropped into the %TEMP% directory of Windows.

"This is a well-documented design behavior, but we're seeing these getting abused by attackers now," he points out.

Half of the attack is achieved by dropping the malicious component on the endpoint, but it needs to be executed in order to fully compromise the machine. CVE-2017-8750 does this by executing the object to complete the attack and drop the Formbook malware.

Formbook, the final payload in this scenario, is a commercially available malware capable of taking screenshots, stealing personally identifiable information, keylogging, and downloading additional components if and when it needs to. Menlo researchers believe this is the first time Formbook has been delivered in this specific way.

While it's not a complete banking Trojan, Pidathala points out that it does have a banking component built into it. Full banking Trojans are solely built for stealing banking credentials; he describes this as "more like a RAT that has a lot of functionalities built into it."

This attack signifies a broader trend of threat actors leveraging remotely hosted objects to sneak past security defenses. In 2017, there were many zero-day exploits capable of fetching remote objects from the Internet and exploiting them in the context of Word, which researchers say was the only Office application used for this attack.

Now, attackers have begun to chain exploits with design behaviors to call remotely hosted malicious objects and run them without raising any red flags to the victim.

"All they have to do is open the first-stage document and that's pretty much it," says Pidathala, emphasizing the lack of user interaction needed to successfully launch the attack. "From there, they don't have to click anything or interact with the malicious document in any way."

It's difficult to tell an attack is taking place. "They're not able to identify anything malicious about it because all there is, is a reference to an external URL," says Menlo CTO Kowsik Guruswamy. "Technically it's not malicious; it's just a URL that happens to follow through with all the second- and third-stage droppers."

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19619
PUBLISHED: 2019-12-06
domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
CVE-2019-19616
PUBLISHED: 2019-12-06
An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment fun...
CVE-2019-19617
PUBLISHED: 2019-12-06
phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
CVE-2012-1114
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.
CVE-2012-1115
PUBLISHED: 2019-12-05
A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.