Vulnerabilities / Threats

4/9/2018
12:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

RTF Design, Office Flaw Exploited in Multi-Stage Document Attack

Threat actors chained CVE-2017-8570 with known design behaviors in .docx and RTF to launch a multi-stage document attack.

A newly discovered multi-stage document attack exploits design behaviors in .docx and RTF, along with CVE-2017-8570, to drop a malicious payload called Formbook on target endpoints. Attackers bypass traditional security tools with embedded URLs instead of active code.

Researchers at Menlo Security Labs who isolated the second-stage document say the behaviors enabling this attack are not new, but that this threat demonstrates an increasingly common way for hackers to slip past security defenses by relying on remotely hosted malicious objects.

"What we discovered is a new way in which Windows is getting the second-stage payload," says Vinay Pidathala, Menlo's director of security research. "There's absolutely no macros, no shellcode being used, just a URL. When the victim opens the document, it will go and fetch the remotely hosted components and load it in the context of the Word process."

The first stage of this attack is a phishing email with a malicious .docx file attached. The file does not have any macros, nor does it use any exploits, and embedded in its frame section is the URL. If the doc is opened, Word makes an HTTP request to download the remote object the URL is pointing to, which in this case redirects to another URL that points to a malicious RTF file.

Attackers are abusing capabilities in Microsoft Word that were more commonly used when it was an HTML editor, says Pidathala. Nobody uses Word to edit HTML anymore, he says, but those functions and API calls still exist and threat actors are taking advantage of them.

The RTF file contains an embedded script and another exploit, he continues. It marks stage two of the attack, which abuses both a design behavior in RTF documents and the CVE-2017-8570 vulnerability. When an RTF document with an embedded objected is opened, the object is automatically dropped into the %TEMP% directory of Windows.

"This is a well-documented design behavior, but we're seeing these getting abused by attackers now," he points out.

Half of the attack is achieved by dropping the malicious component on the endpoint, but it needs to be executed in order to fully compromise the machine. CVE-2017-8750 does this by executing the object to complete the attack and drop the Formbook malware.

Formbook, the final payload in this scenario, is a commercially available malware capable of taking screenshots, stealing personally identifiable information, keylogging, and downloading additional components if and when it needs to. Menlo researchers believe this is the first time Formbook has been delivered in this specific way.

While it's not a complete banking Trojan, Pidathala points out that it does have a banking component built into it. Full banking Trojans are solely built for stealing banking credentials; he describes this as "more like a RAT that has a lot of functionalities built into it."

This attack signifies a broader trend of threat actors leveraging remotely hosted objects to sneak past security defenses. In 2017, there were many zero-day exploits capable of fetching remote objects from the Internet and exploiting them in the context of Word, which researchers say was the only Office application used for this attack.

Now, attackers have begun to chain exploits with design behaviors to call remotely hosted malicious objects and run them without raising any red flags to the victim.

"All they have to do is open the first-stage document and that's pretty much it," says Pidathala, emphasizing the lack of user interaction needed to successfully launch the attack. "From there, they don't have to click anything or interact with the malicious document in any way."

It's difficult to tell an attack is taking place. "They're not able to identify anything malicious about it because all there is, is a reference to an external URL," says Menlo CTO Kowsik Guruswamy. "Technically it's not malicious; it's just a URL that happens to follow through with all the second- and third-stage droppers."

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Cybercriminals Clean Their Dirty Money
Alexon Bell, Global Head of AML & Compliance, Quantexa,  1/22/2019
Facebook Shuts Hundreds of Russia-Linked Pages, Accounts for Disinformation
Sara Peters, Senior Editor at Dark Reading,  1/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1637
PUBLISHED: 2019-01-23
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Fo...
CVE-2019-1638
PUBLISHED: 2019-01-23
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Fo...
CVE-2019-1639
PUBLISHED: 2019-01-23
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Fo...
CVE-2019-1640
PUBLISHED: 2019-01-23
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Fo...
CVE-2019-1641
PUBLISHED: 2019-01-23
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Fo...