Booby-trapped Word documents in the wild exploit critical Microsoft zero-day

12 April, 2017, 02:46 | Author: Lorena Waters
  • Microsoft Zero Day attacks see hackers target Word users with new bug that affects every version

Microsoft Tuesday patched a previously undisclosed Word zero-day vulnerability attackers used to install a variety of malware on victims' computers.

The attack starts with an e-mail that attaches a malicious Word document, according to a blog post published Saturday by researchers from security firm FireEye. A team of researchers found malicious Microsoft Office files which download and install malware from various web servers when the document is opened.

The.hta executable bypasses memory-based mitigations put into place by Microsoft and gives attackers the ability to execute arbitrary code on the victim's system, McAfee said.

As the means through which cyber-attackers stole more than £20 m, it had been mentioned in 2015. Second, unlike the vast majority of the Word exploits seen in the wild over the past few years, this new attack doesn't require targets to enable macros. The vulnerability was traced to the Windows Object Linking and Embedding (OLE) component present in Office software that enables users to link to content in their documents.

Rival security firm FireEye on Saturday appeared to take credit for finding the bug in a blog post titled "Acknowledgement of Attacks Leveraging Microsoft Zero Day", in which it said it had worked with Microsoft for "several weeks" but disclosed the issue due to McAfee's blog.

A Microsoft spokesperson has confirmed that the company will offer a patch to rectify the issue, which will be available on Tuesday as part of the software giant's monthly release of updates.

White House Says Trump Open to More Action in Syria
Barrel bombs are oil drums or cylinders packed with explosives and shrapnel. Spicer mumbled the question back to himself before finally answering.

Be careful when you receive a suspicious email with a Word document attached to it. "In the background, the malware has already been stealthily installed on the victim's system", adds the team. When the user begins the document, winword.exe concerns an HTTP request to a remote server to recover a malicious.hta file, which seems as a fraudulent RTF file.

Within Trust Center, enabling the GPO that uses File Block to block.rtf files, not even allowing for them to be opened in "Protected View".

The exploit's existence was revealed Friday by security researchers from antivirus vendor McAfee, but targeted attacks using it have been happening since January. "Once the vulnerability becomes known, a race begins for the developer, who must protect users". The unsafe malware exploits work reportedly on all Microsoft office versions and that includes the latest versions, the office 2016 that is now running on Windows 10.

Until then, McAfee advises users to only run Office in Protected View mode as well as to refrain from opening "any Office files obtained from untrusted locations".

The Protected View feature built into Microsoft Office makes the attack vector ineffective.

Recommended:

  • Student killed in Venezuela protests: prosecutors

    Student killed in Venezuela protests: prosecutors

    The opposition's demands include that authorities set a date for gubernatorial elections that have been postponed indefinitely. More than a dozen metro stations in the Venezuelan capital, Caracas, have been closed ahead of an anti-government protest.
    Toshiba's survival in doubt amid Westinghouse troubles

    Toshiba's survival in doubt amid Westinghouse troubles

    Toshiba's inability to report earnings has also raised speculation of a possible delisting from the Tokyo Stock Exchange. Apart from its embattled nuclear segment, Toshiba's other operations are healthy, Tsunakawa said.
    NY set to make state college tuition free for middle class

    NY set to make state college tuition free for middle class

    The deal includes both the State Universities of ny , or SUNY, and the City Universities of ny program, known as CUNY . That means NY will be the first state to put a policy into action that grants free tuition assistance to students.
  • Massive rally in Budapest in support of Soros-funded university

    Massive rally in Budapest in support of Soros-funded university

    Yee told Reuters that, while the new law hurt the university and academic freedoms, Hungary remained a key USA ally. Protesters filling Kossuth Square outside Parliament said they want President Janos Ader to veto the legislation.
    House Intelligence Member Rep. Pete King: Rice Appearance Before Intelligence Panels

    House Intelligence Member Rep. Pete King: Rice Appearance Before Intelligence Panels "Likely"

    There is no other reasonable or plausible explanation for why Rice specifically targeted members of the Trump campaign. Schiff has declined to comment on the contents of the documents, while Nunes has said they caused him concern.
    United States  takes best shot at landing FIFA World Cup with joint bid

    United States takes best shot at landing FIFA World Cup with joint bid

    He is especially pleased that Mexico is part of this bid and that's in the last few days we've got further encouragement on that. It looks like the US and CONCACAF know it. "We have a unique opportunity to be the first country to host three World Cups ".
  • Call of Duty: Black Ops 2 Now Backward Compatible on Xbox One

    Call of Duty: Black Ops 2 Now Backward Compatible on Xbox One

    This is fantastic news and we're extremely happy that we'll be able to play one of the best games in the Call of Duty series. Modern Warfare 2 and Modern Warfare 3 follow close behind.
    Tony Romo's honorary Mavericks day turns into spectacle

    Tony Romo's honorary Mavericks day turns into spectacle

    I think I'm going to going to get more street cred for being on the bench for the Mavericks than actually playing for the Cowboys. Sean [Payton] would call in and then eventually he passed the phone to Jerry [Jones], so you went through the whole gamut".

    Sergio Garcia wins the Masters, ends drought at the majors

    His birdie putt missed, too. "I think this is a tournament I'm going to win one day", Rose, 36, said when it was over. It beat Englishman Justin Rose . "Even after the two bogeys, I felt there were some holes I could go after".
  • US scuppers G7 bid to find joint stance on energy and climate

    US scuppers G7 bid to find joint stance on energy and climate

    Former ExxonMobil CEO turned Secretary of State Rex Tillerson has spoken on his support of the Paris agreement in the past. President Barack Obama committed the U.S.to cut emissions 26 to 28 percent by 2025.
    McDavid hits 100 points, Ducks clinch NHL Pacific title

    McDavid hits 100 points, Ducks clinch NHL Pacific title

    McDavid hit the 100-point plateau on the Oilers' fifth goal just over a minute later, setting up Draisaitl's 29th of the year. In his second season, 2006-07, Crosby won the Art Ross as scoring leader, the Hart Trophy as MVP, and the Lester B.
    How Efe won Big Brother Naija 'See Goobe' edition

    How Efe won Big Brother Naija 'See Goobe' edition

    The night started with Marvis getting evicted from the house, which came as a surprise to many of her fans. The One campaign will make Bisola represent Nigeria at the United Nations later in the year.


Popular

Thor: Ragnarok Trailer Gives Glimpse of Hero Without Hammer and Hulk Battle
The final moments of Age of Ultron seemed to indicate that the Quinjet crashed near Fiji, but Hulk was never found. Finally, and perhaps most likely, Hulk could be brought to Sakaar by either the Grandmaster or Valkyrie.

Amnesty hails 37% fall in global executions
The partial dataset showed that the majority of the people whose death sentences were confirmed were either farmers or unemployed. In 2015 Amnesty International recorded 1,634 executions in 25 countries worldwide - a historical spike unmatched since 1989.

Shares in chipmaker Dialog plunge over Apple contract doubts
The report goes on to suggest Apple might need to hire more than 1,000 engineers to completely replace its business with Dialog. About 80 engineers at Apple are working on chips for use as soon as 2019, he said , citing unnamed industry sources.

BC Liberals stand pat with platform
New Democrats reportedly planning to release their housing platform on Thursday - the issue may be the Opposition's to lose on. It touted previous promises including eliminating unpopular medical services premiums over the long term.

Obama expected at Protestant event in Berlin next month
Barack Obama will meet with German Chancellor Angela Merkel in her home country late next month for a panel on democracy. The Obama Foundation said the discussion, which it will co-host, would be its first worldwide event.