Microsoft Office: The Go-To Platform for Zero-Day Exploits

Malicious Office documents are the weapon of choice among cybercriminals, who use files to access remotely hosted malicious components.

Email is a common means of delivering cyberattacks, and Microsoft Office documents are commonly attached to malicious emails. More threat actors are using Word and Excel files to deliver zero-day exploits that are getting more dangerous and even harder to detect.
Researchers at Menlo Security dug further into the connection between Microsoft Office documents and cybercrime. They found attackers are increasingly using malicious Office docs for endpoint exploitation but instead of attaching files packed with malicious macros, they use Office docs to call remotely hosted malicious components, launching exploits in the browser.
Using Office documents in emailed cyberattacks is not new. Some companies send legitimate files with macros enabled; knowing this, threat actors began to use them as a means of infecting endpoints. Unfortunately for them, security tools have become more adept and users have become more security savvy. Fewer are clicking enable macros to launch attacks.
As a result, threat actors are shifting their strategies. They dont want the user to click anything for a malicious document to be exploited.
There is a shift in the TTPs that the attackers are using, explains Vinay Pidathala, Menlos director of security research. In late 2017 and early 2018, pretty much all the zero-days getting exploited have used Word, and used remote malicious components to exploit the endpoint.
CVE-2017-0199: Where the Trouble Started
Several vulnerabilities have allowed these exploits to happen, Pidathala says.
CVE-2017-0199
, published in 2016, is one. The Microsoft Office/WordPad remote code execution vulnerability exploits a logic flaw in Microsoft Word. It appeared in the wild in 2016, when an attack used Word files containing an embedded object that fetched a remote resource from the Web.
This bug lets attackers run code on target systems using the Object Linking and Embedding (OLE) technology in Windows to deliver malware. Anyone who successfully exploited the flaw could control target systems, create new accounts, and view, edit, and delete data.
CVE-2017-0199 was the start of it all, says Pidathala. Attackers could remotely host their malicious content online; by opening the doc, their target could fetch the resource and get it onto the endpoint without an application displaying any warnings about potential infection.
The trend of remotely hosting cyberthreats continued to grow. A more
current example
can be seen in CVE-2018-8174, a Windows VBScript Engine Remote Code Execution Vulnerability, which exploits the library used by Internet Explorer to render Web pages. The so-called Double Kill bug could let an attacker execute code with the current users privileges.
An attack starts with a spearphishing email with a malicious RTF file attached. The document contains an OLE object; when activated, it downloads and renders an HTML page through a library that contains the engine behind Internet Explorer. VBScript on the page uses the exploit to download a payload to the endpoint.
Its worth noting Microsoft has patched both CVE-2017-0199 and CVE-2018-8174; however, both individuals and businesses may be behind on their patching and should be aware.
Why Office Documents?
Microsoft Office is an increasingly common platform to launch these attacks because many applications that were once exploited in the browser can also be accessed using a Word document, Pidathala explains.
With CVE-2018-8174, for example, attackers could have targeted a vulnerable version of IE directly without using Word as a conduit. However, links sent in malicious emails will open in IE if clicked, even if the target uses a different default browser. Attackers dont need to use Word either; they could leverage other Office document types to achieve the same goals.
Internet Explorer isnt the default browser on many Windows systems, he continues, especially with the arrival of Edge in Windows 10. However, by embedding an Internet Explorer zero-day and delivering it through Word, an attacker can hit targets who dont have IE set by default.
The reason were seeing a rise in remotely hosted components is because most security systems differentiate good vs. bad content,
researchers explain
. A malicious document only containing a link wont trigger most sandboxes or antivirus solutions to block it.
Most controls cant detect these kinds of things because of the blended nature of the threat, Pidathala continues. Businesses often allocate less resources toward prevention; typically, industry techniques focus on remediation after the infection has been detected.
Related Content:
AppSec in the World of Serverless
The Best and Worst Tasks for Security Automation
Mylobot Malware Brings New Sophistication to Botnets
Most Websites and Web Apps No Match for Attack Barrage
Why Cybercriminals Attack: A DARK READING VIRTUAL EVENT Wednesday, June 27. Industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Go
here
for more information on this free event.

Last News
▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security	▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Office: The Go-To Platform for Zero-Day Exploits