Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/9/2018
12:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

RTF Design, Office Flaw Exploited in Multi-Stage Document Attack

Threat actors chained CVE-2017-8570 with known design behaviors in .docx and RTF to launch a multi-stage document attack.

A newly discovered multi-stage document attack exploits design behaviors in .docx and RTF, along with CVE-2017-8570, to drop a malicious payload called Formbook on target endpoints. Attackers bypass traditional security tools with embedded URLs instead of active code.

Researchers at Menlo Security Labs who isolated the second-stage document say the behaviors enabling this attack are not new, but that this threat demonstrates an increasingly common way for hackers to slip past security defenses by relying on remotely hosted malicious objects.

"What we discovered is a new way in which Windows is getting the second-stage payload," says Vinay Pidathala, Menlo's director of security research. "There's absolutely no macros, no shellcode being used, just a URL. When the victim opens the document, it will go and fetch the remotely hosted components and load it in the context of the Word process."

The first stage of this attack is a phishing email with a malicious .docx file attached. The file does not have any macros, nor does it use any exploits, and embedded in its frame section is the URL. If the doc is opened, Word makes an HTTP request to download the remote object the URL is pointing to, which in this case redirects to another URL that points to a malicious RTF file.

Attackers are abusing capabilities in Microsoft Word that were more commonly used when it was an HTML editor, says Pidathala. Nobody uses Word to edit HTML anymore, he says, but those functions and API calls still exist and threat actors are taking advantage of them.

The RTF file contains an embedded script and another exploit, he continues. It marks stage two of the attack, which abuses both a design behavior in RTF documents and the CVE-2017-8570 vulnerability. When an RTF document with an embedded objected is opened, the object is automatically dropped into the %TEMP% directory of Windows.

"This is a well-documented design behavior, but we're seeing these getting abused by attackers now," he points out.

Half of the attack is achieved by dropping the malicious component on the endpoint, but it needs to be executed in order to fully compromise the machine. CVE-2017-8750 does this by executing the object to complete the attack and drop the Formbook malware.

Formbook, the final payload in this scenario, is a commercially available malware capable of taking screenshots, stealing personally identifiable information, keylogging, and downloading additional components if and when it needs to. Menlo researchers believe this is the first time Formbook has been delivered in this specific way.

While it's not a complete banking Trojan, Pidathala points out that it does have a banking component built into it. Full banking Trojans are solely built for stealing banking credentials; he describes this as "more like a RAT that has a lot of functionalities built into it."

This attack signifies a broader trend of threat actors leveraging remotely hosted objects to sneak past security defenses. In 2017, there were many zero-day exploits capable of fetching remote objects from the Internet and exploiting them in the context of Word, which researchers say was the only Office application used for this attack.

Now, attackers have begun to chain exploits with design behaviors to call remotely hosted malicious objects and run them without raising any red flags to the victim.

"All they have to do is open the first-stage document and that's pretty much it," says Pidathala, emphasizing the lack of user interaction needed to successfully launch the attack. "From there, they don't have to click anything or interact with the malicious document in any way."

It's difficult to tell an attack is taking place. "They're not able to identify anything malicious about it because all there is, is a reference to an external URL," says Menlo CTO Kowsik Guruswamy. "Technically it's not malicious; it's just a URL that happens to follow through with all the second- and third-stage droppers."

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.
CVE-2016-4606
PUBLISHED: 2020-02-21
Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...