{"id":9281,"date":"2017-09-13T20:56:36","date_gmt":"2017-09-14T04:56:36","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/09\/13\/news-3054\/"},"modified":"2017-09-13T20:56:36","modified_gmt":"2017-09-14T04:56:36","slug":"news-3054","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/09\/13\/news-3054\/","title":{"rendered":"PSA: New Microsoft Word 0day used in the wild"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 13 Sep 2017 22:49:19 +0000<\/strong><\/p>\n

Microsoft has just patched<\/a> an important vulnerability in Microsoft Word during its latest patch Tuesday cycle. According to the security firm that found it [1], this new zero-day (CVE-2017-8759<\/a>) was used in targeted attacks to install a piece of malware known as FinFisher.<\/p>\n

Microsoft Office has been in the line of fire<\/a> throughout the year with malware distributors employing various social engineering techniques to trick users into opening up booby-trapped documents laced with exploits or macros. Indeed, while drive-by download activity has plummeted, malicious spam has been the dominant threat.<\/p>\n

In this blog post, we do a quick review of this latest exploit and how future attackers are likely to add it to their own campaigns.<\/p>\n

Infection flow<\/h3>\n

CVE-2017-8759 leverages an improper validation in a parsing module of the Web Services Description Language (WSDL<\/a>) which leads to arbitrary code injection and execution. As we have seen it many times in previous attacks, mshta.exe<\/em> is used to retrieve a script and eventually the malware payload.<\/p>\n

\"\"<\/a><\/p>\n

Figure 1: Traffic view showing script and payload retrieval<\/em><\/p>\n

\"\"<\/a><\/p>\n

Figure 2: Process view showing infection technique<\/em><\/p>\n

Payload delivery implications<\/h3>\n

Depending on how the malicious document is delivered, it can require little or no user interaction in order to infect the target. In the former case, the document could be downloaded from a website or come as spam. It would bear the Mark of the Web<\/a> and be flagged. In the latter case where the document was packaged – for example using 7zip – it could lose that MotW [2].<\/p>\n

\"\"<\/a><\/p>\n

Figure 3: Side-by-side comparison of the same file, distributed differently.<\/em><\/p>\n

In the first case, the user will be prompted to “Enable Editing” (which admittedly is less suspicious than enabling macros). This, in turn, will trigger the malicious code to execute.<\/p>\n

\"\"<\/a><\/p>\n

Figure 4:\u00a0CVE-2017-8759 attempt blocked (Protected View mode)<\/em><\/p>\n

In the second case, where the MotW has been lost, the malicious Word document will immediately run its payload:<\/p>\n

\"\"<\/a><\/p>\n

Figure 5:\u00a0CVE-2017-8759 attempt blocked (normal mode)<\/em><\/p>\n

If you haven’t done it yet, we strongly advise you to run Windows updates and apply the latest security patches. If experience serves well, each time a new zero-day is exposed, other online criminals jump in and rush to add it to their arsenal. This means that what was a small and targeted attack can all of the sudden become a widespread campaign.<\/p>\n

Malwarebytes<\/a> users were already protected against this exploit when it was still a zero-day. Additionally, we detect and block the FinFisher malware payload.<\/p>\n

References<\/h3>\n

[1] FireEye,\u00a0https:\/\/www.fireeye.com\/blog\/threat-research\/2017\/09\/zero-day-used-to-distribute-finspy.html<\/a><\/p>\n

[2] Eric Lawrence,\u00a0https:\/\/textslashplain.com\/2016\/04\/04\/downloads-and-the-mark-of-the-web\/<\/a><\/p>\n

Indicators of compromise<\/h3>\n

Malicious Word document:<\/p>\n

0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684<\/pre>\n
FinFisher:<\/p>\n
b035ca2d174e5e4fd2d66fd3c8ce4ae5c1e75cf3290af872d1adb2658852afb8<\/pre>\n
Network traffic:<\/p>\n
91.219.236[.]207\/img\/office.png  91.219.236[.]207\/img\/word.db  91.219.236[.]207\/img\/left.jpg<\/pre>\n
The post PSA: New Microsoft Word 0day used in the wild<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 13 Sep 2017 22:49:19 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Read more about the latest Microsoft Word Zero-Day and how to protect yourself against it.<\/p>\n
Categories: <\/p>\n