iSIGHT discovers vulnerability used in Russian cyber-espionage campaign(isightpartners.com) |
iSIGHT discovers vulnerability used in Russian cyber-espionage campaign(isightpartners.com) |
* An exposed dangerous method vulnerability exists in the OLE package manager in Microsoft Windows and Server (Vista SP2 to Windows 8.1, Windows Server versions 2008 and 2012)
* When exploited, the vulnerability allows an attacker to remotely execute arbitrary code
* The vulnerability exists because Windows allows the OLE packager (packager .dll) to download and execute INF files. In the case of the observed exploit, specifically when handling Microsoft PowerPoint files, the packagers allows a Package OLE object to reference arbitrary external files, such as INF files, from untrusted sources.
* This will cause the referenced files to be downloaded in the case of INF files, to be executed with specific commands * An attacker can exploit this vulnerability to execute arbitrary code but will need a specifically crafted file and use social engineering methods (observed in this campaign) to convince a user to open it
TL;DR - A vulnerability exists in INF processing and untrusted, 3rd party INF files can be included by PowerPoint files. This is not a worm.
Also these little gems:
> Further information will be provided in a live briefing to any interested parties on Thursday, October 16th at 2:00...
> iSIGHT is making available a broader technical report – inclusive of indicators – through a formal vetting process.
Fuck you iSIGHT. This is being used in the wild and a patch has been released. Post the details publicly. This isn't responsible disclosure, this is PR and lead gen.
Seeing how all of the other articles about this exploit are basically regurgitating iSight's announcement, I thought I'd provide something a little bit more useful.
https://www.virustotal.com/en/file/70b8d220469c8071029795d32...
edit: The meat of the vulnerability is in the "Working with Microsoft, we discovered the following" section, over halfway down the page.
What's next, "Zero-day Impacting All Versions of All Operating Systems - allows users to download and execute arbitrary code"? I suppose if you're a fan of user-hostile walled-garden trusted-computing models you might consider that a vulnerability, but I think it's safe to assume that most people consider the ability to "download and execute arbitrary code" to be a very useful and fundamental feature of an OS.
from Vista SP2 to Windows 8.1
I'm curious if this "vulnerability" also exists in XP.
That is absolutely an exploit, similar to if I linked to an imgur jpeg that actually ran a trojan on your machine.
Also secure environments often strip down the ability to download and run arbitrary code, but might still allow theoretically-data-only formats to be downloaded and opened (such as .ppt files), in which case this is definitely relevant.
I was curious as well. Elsewhere the article says it's not vulnerable:
...a zero-day vulnerability impacting all supported versions of Microsoft Windows (XP is not impacted)
Are there any significant Windows vulnerabilities for XP since the EOL? I was waiting for the first one that isn't patched, will be interesting to see how the bad guys use it.
> When exploited, the vulnerability allows an attacker to remotely execute arbitrary code
go along with
> [...] will need a specifically crafted file and use social engineering methods (observed in this campaign) to convince a user to open it [...]
Is this a fucking joke? Looks like some company just want to push their name out there and get some free media exposure.
So the process is initiated through a spearphish, and when the file is opened the vulnerability causes the system to download additional code and execute it.
I think they're trying to get on the Heartbleed and Shellshock bandwagon by trying to get a name all over the media for a fairly minor exploit.
"Over the past 5 weeks, iSIGHT Partners worked closely with Microsoft to track and monitor the exploitation of this vulnerability..."
I'm sorry, I feel you should lose the right to call this a zero day when both you and Microsoft have known not only its existence, but the fact that it's being actively exploited for five freaking weeks. Also, am I the only one that feels this reads as a sensationalist article? I think the phrase "weaponized PowerPoint file" was what ended up pegging my meter, but the fact it's not a worm and barely fits the category of remote code execution helps.
Perhaps they could have phrased it more clearly, but considering that it sounds like a full exploit on opening a powerpoint document, some alarm is appropriate.
I also think it was a little brash to name it "Sandworm" when it is not, as far as we know, a worm. It certainly has the potential to be used as the key exploit in a worm though.
Content of the email, for those interested: http://pastebin.com/AZBcQ2DF
So, it's a remote exploit, but requires the user to open a document.
Here are some more details: http://www.tripwire.com/state-of-security/incident-detection...
Trust me, if the vulnerability is important and has merit, you'll get the street cred among other security researchers and the potential employers that would hire you because of the work you did and your skills.
See Mike Lynn's massively bad RCE vuln in Cisco Routers or Dan Kaminsky's huge DNS vulnerability as examples on disclosing terrible problems with class.
This is really worrying. Especially that Poland now tries to break from Russia's energy hegemony.
Why not the 15th?
> How to embed PowerPoint presentations in your web pages.
> Once you've created the PowerPoint presentation, embedding it on a Web page is as easy as saving it to the Web, grabbing the embed code and pasting it onto your page - no code required. Visitors to your site will then be able to page through the presentation and interact with it directly on your Web page, from within the browser and without having to have PowerPoint installed.
http://www.microsoft.com/web/solutions/powerpoint-embed.aspx
Security has become a marketing and media circus now which in turn desensitizes people to real concerns and rational thought.
Attribution and PR aside, branding these helps educate the public and give them something tangible to call it/discuss.
[1] The games were great, if unrelated to the story. The film is ridiculous and uses the books merely as backdrop.
[2] Pedantic I know, but the books had pictures on the covers that showed exactly what a sandworm should look like – e.g. visible crystal teeth of a size that could be made into a dagger (a crysknife) and a hot furnace behind – not three weird flaps around a dark mouth.
I think that soon there will be multiple names for each new vulerability with multiple logo-ed/brand-ed info pages. And then this trend will start to die out.
But for now, you should be worried about the latest Vulnerability[tm].
For example, my manager even heard about "shell shock" and prompted me to do something about it. Although, it was over a week after the outbreak, and we'd already established we weren't vulnerable (applied the patch anyway) - but even so!