A new targeted attack which exploits the way Microsoft Office handles images is attacking victims in the Middle East and South Asia. darkREADING reports on the exploit in detail. Of particular interest to followers of Iconix is this observation from darkREADING:
Bad guys can exploit the flaw that affects Windows, Office, and Lync by luring a victim into previewing or opening an email with a malicious file attachment or to visit a malicious URL. The end game is that the attacker can take over the machine. Microsoft has released a temporary Fix it patch for protection against attacks until it either issues a patch via its Patch Tuesday schedule or an out-of-band update.
The exploit was discovered by McAfee Labs on October 31, 2013. Significant technical detail is provided by McAfee Labs. Of particular significance is:
It is worth to note that this heap-spraying in Office via ActiveX objects is a new exploitation trick which we didn’t see before, previously attackers usually chose Flash Player to spray memory in Office. We would believe the new trick was developed under the background that Adobe introduced a click-to-play feature in Flash Player months ago, which basically killed the old one. This is another proof that attacking technique always tries to evolve when old ones don’t work anymore.
On November 5, Microsoft released Microsoft Security Advisory (2896666), Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution
This is the now familiar spearphishing kill chain:
This attack combines two factors to implement the kill chain – human deception and a technical exploit. Attackers use social engineering to guide people into bad decisions in order to install technical exploits. IT needs to help employees make better email processing decisions. That is where SP Guard comes into play. Using SP Guard, IT can determine a list of trusted senders and provide this information to staff in a simple and highly effective manner.
You can contact us at 408-727-6342,ext 3 or use our online form.