7 ms·
Microsoft: 0Day Exploit Targeting Word, Outlook
- mpyne 13y agoWell there goes half of .gov and .mil... (at least the agencies not forcing plain text email)
- yuhong 13y agoFortunately, I think the current exploits rely on ActiveX controls which are disabled when reading Outlook RTF messages. In fact, I have seen no real world Word exploits using Outlook RTF messages, probably because spear phishing is effective enough.
- justincormack 13y ago"One way to harden your email client is to render emails in plain text" er yes.
- dsl 13y agoThis is one of the biggest false assumptions that I see smart people making. Unless you have verified the implementation under the hood, you have no knowledge that the parser and renderer are not being executed on a rich text part regardless of what is displayed on the screen.
- bananas 13y agoUnless it's multi-part MIME which is usually the encapsulation mode for RTF based email. In that case, there's usually a plain text copy attached to the body as well which doesn't need to be read by the parser or any of the rich text stuff. Confirmed: Content-Type: multipart/alternative; boundary="_000_1B81DC42240AEE4B96F487A2683E7EEB0A6AE7505BTHHS2E12BE2Xh_" MIME-Version: 1.0 --_000_1B81DC42240AEE4B96F487A2683E7EEB0A6AE7505BTHHS2E12BE2Xh_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable RTF test From outlook 2013 in RTF mode... And I use mutt for my personal email...
- Xylakant 13y agoIt's unlikely that an attacker uses a well-behaved email-client to attack you. The parent points out that you don't know what your client does if it receives a rich-text (HTML,...)-only email and you set your client to render it as plain text. Your client will probably use some sort of parser to tell the formatting from the content and remove the formatting. If that is the "regular" parser, you're still vulnerable.
- dsl 13y ago...and if the vulnerability is in the MIME parser itself?
- bananas 13y agoIt wouldn't be if the mitigation was to stop viewing RTF as it says on technet...
- dijit 13y agoEveryone in my office runs MS Office for inane reasons, I did try to make them move to openoffice/libreoffice w/ thunderbird, we run an open stack behind the scenes and things simply integrate better.. I feel like this is a massive 'told ya so' after spending thousands of pounds of company money on licenses, now I'll have to spend hours of my time fixing everyones machine one by one, just in case. >_< hopefully a fix comes in soon and I don't have to worry too much, I assume it will but getting everyone to update (well, forcing it) is a bit hard too.
- spacehome 13y agoSerious question -- I don't intend to troll -- I've heard lots of people claim that as soon as OpenOffice et al. get more popular, more malware will target them. It's not as if Microsoft has a monopoly on bugs. Do you think there's ay truth to this line of thinking?
- danielweber 13y agoFrom a security situation, the worst situation is everyone running different mail clients, because then if any one of them has a vulnerability someone can send in a crafted mail to take over their box and gain access to your private company docs. "Monoculture" isn't always bad.
- niels_olson 13y agoI don't understand this theory that monoculture is safer in a corporate environment. Any interesting organization has more than one secret recipe. Virtually everyone has different access to different systems. If they are all vulnerable to the same bug, the attacker quickly gains control of everything. If they gain control of a single segment, then they can be detected. The odds of the attack being identified once that segment is compromised is much higher, since everyone else has the opportunity to identify the bad behavior.
- mpyne 13y ago
- Sniffnoy 13y agoI'm confused by the idea that there could be a vulnerability while reading RTFs, of all things. Annoying; I frequently send out documents in RTF format to make sure everyone can read them...
- ne0codex 13y agoI stick with .pdf files However, that might be bad practice.
- mpyne 13y agoWith Adobe Reader it's probably even worse, to be honest.
- rplnt 13y agoFor the past few years I've been using Chrome as a PDF reader (I don't use it as my primary browser, but have it nonetheless). I'm not saying Chrome can't be vulnerable... it's just good to get rid of such pointless software as PDF reader. Especially if the case is the bloated Acrobat Reader (though I think the UX was great with that one).
- aric 13y agoThere have been countless (known) RTF vulnerabilities for over a decade.
- bananas 13y agoAny data format that is read by an unsafe language (i.e. C/C++ here most likely) is prone to remote execution. They are pretty much like wandering around with a machine gun with the safety off. This is perfectly fine if you're trained for years to do this (Queens guard for example) but some drunk redneck (which is most of us, me included) will inevitably kill people. Typical example of a buffer overflow that leads to execution specific to this case, although I'm sure this has been posted a million times here: 1. RTF parser allocates char[15] on the stack for storing the font family from {\fonttbl\... 2. Joe hacker shifts out a font definition of 15 chars plus a return address to some arbitrary code and the code itself. 3. The parser reads until the end of the fonttbl definition ;} which is longer than the buffer specified. 4. This blindly overwrites the return address by writing beyond the end of the buffer and pokes some arbitrary code on the end. If you're lucky this won't cause a bus error / MMU trap 5. The function returns and the malicious return address is jumped to executing Joe Hackers code. Ultimately anyone can make this mistake when programming in C/C++ and they frequently do. It takes considerable skill to not blow your toes off like this. There are certain mitigation method which prevent this but they aren't universally enabled or available or 100% effective. I've pretty much given up on C these days but I spent a lot of time making sure stuff like this was impossible and most importantly avoided parsing anything myself when nice tools like lex/yaxx are around that have all this stuff safely wrapped up. I didn't win every time.
- mysteriousllama 13y agoI do wish they would tell us if EMET[1] is an effective mitigation for this vulnerability or not. Considering it involves memory corruption it's likely.. But finding out the hard way would be no fun. [1] http://support.microsoft.com/kb/2458544 http://support.microsoft.com/kb/2458544
- pedro84 13y ago"First, our tests showed that EMET default configuration can block the exploits seen in the wild." http://blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx http://blogs.technet.com/b/srd/archive/2014/03/24/security-a...
- lawnchair_larry 13y agoIt's usually the case that EMET blocks the "standard" exploit, but it can be bypassed with a little more work. It depends on the bug, but there are real world cases for which many have exploits that fully bypass EMET with all settings on.
- NKCSS 13y agoFunny that the C&C's IP (185.12.44.51) reveals that the machine was used to confirm bitcoin transactions... Pretty sure it will try to rob you ;)