Vulnerabilities / Threats

1/16/2018
12:59 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Most Common Exploits of 2017 in Microsoft Office, Windows

The most common exploit affects Microsoft Office and has been used by attackers in North Korea, China, and Iran.

The most popular exploits in 2017 targeted Microsoft Office and Windows, report researchers at AlienVault, who say the most common flaws remain exploited for a long period of time.

Each year, the company records anonymized security events from customers and from other vendors' threat reports recorded via its Open Threat Exchange (OTX) platform. It combines findings from the two datasets into a single picture of the year's threat landscape.

There is significant difference between the most common exploits reported by vendor reports on OTX, and from AlienVault's customers. The dataset of 80 vendor reports indicates four of the top 10 exploits from 2017 target Microsoft Windows and three affect Office. There is one vulnerability each for Adobe Flash, Microsoft .NET, and Android/Linux on the list.

The top-ranked exploit, CVE-2017-0199, is an Office exploit that has been used by targeted attackers in North Korea, China, and Iran, as well as by criminal groups deploying Dridex. CVE-2012-0158, the third most-referenced vulnerability, affects Microsoft Windows.

AlienVault threat engineer Chris Doman reports Microsoft has "exceptionally mature" processes to prevent exploits. However, because its software is so widely used, exploits that slip through the cracks are used heavily once they are discovered.

In contrast with the vendors' threat reports, the AlienVault customer dataset is very large and contains billions of security events. Many of the most common exploits reported are fairly old and affect Windows 2000, Miniupnp, SNMP, OpenSSL Poodle, and PHP. There is one Microsoft Office vulnerability (CVE-2011-1277) and an Apache Struts vulnerability on the list.

Doman notes the data is biased toward "noisy" network-based exploit attempts from worms and exploit scanners, which is why the company is still collecting vulnerabilities from 2001 and 2002. It advises consulting the dataset on vendor reports when planning defense tactics.

Other key findings include the discovery that most effective exploits are quickly adopted by criminal and nation-state groups. NjRat malware variants were most common persisting on networks. On a geographical level, they noticed an increase of attackers located in Russia and North Korea, and a "significant drop" in activity coming from threat actors based in China.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18375
PUBLISHED: 2018-10-16
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
CVE-2018-18376
PUBLISHED: 2018-10-16
goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.