According to report from notable Antivirus Company McAfee, who is said to have put in significant efforts in hunting attacks such as advanced persistent threats and “zero days.” Recently suspicious activities were observed from some samples. After quick but in-depth research by McAfee, It was confirmed that the samples are exploiting a vulnerability in Microsoft Windows and Office that is not yet patched.
The samples we have detected are organized as Word files (more especially, RTF files with “.doc” extension name). The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10. The earliest attack we have seen dates to late January.
The exploit connects to a remote server (controlled by the attacker), downloads a file that contains HTML application content, and executes it as an .hta file. Because .hta is executable, the attacker gains full code execution on the victim’s machine. Thus, this is a logical bug, and gives the attackers the power to bypass any memory-based mitigations developed by Microsoft. The following is a part of the communications captured by McAfee:
The .hta content is disguised as a normal RTF file to evade security products, but we can find the malicious Visual Basic scripts in a later part of the file:
The successful exploit closes the bait Word document and pops up a fake one to show the victim. In the background, the malware has already been stealthily installed on the victim’s system.
The root cause of the zero-day vulnerability is related to the Windows Object Linking and Embedding (OLE), an important feature of Office.
Mitigation
- · Do not open any Office files obtained from untrusted locations.
- · According to tests performed by McAfee, this active attack cannot bypass the Office Protected View, so ensure that Office Protected View is enabled always.
y You May also be interested in Windows 10 creators update: new features: How to get it
No comments:
Post a Comment