{"id":36499,"date":"2014-07-15T11:26:22","date_gmt":"2014-07-15T18:26:22","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=36499"},"modified":"2024-02-20T00:15:17","modified_gmt":"2024-02-20T08:15:17","slug":"targeted-attacks-on-french-company-exploit-multiple-word-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/targeted-attacks-on-french-company-exploit-multiple-word-vulnerabilities\/","title":{"rendered":"Targeted Attacks on French Company Exploit Multiple Word Vulnerabilities"},"content":{"rendered":"

Spear phishing email is a major worry to any organization. Messages that appear legitimate and specific fool us more often than random phishing attempts. Exploits that use patched vulnerabilities delivered via spear phishing email are one of the most successful combinations used by attackers to infiltrate targeted organizations and gain access to confidential information.<\/p>\n

During the last month, McAfee Labs researchers have uncovered targeted attacks carried out via spear phishing email against a French company. We have seen email sent to a large group of individuals in the organization. The attachments exploit the recently patched RTF vulnerability CVE-2014-1761 and the previously patched ActiveX control vulnerability CVE-2012-0158. Both of these vulnerabilities have been popular in several ongoing targeted attacks.<\/p>\n

\"t1\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\"t2\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

\\<\/p>\n

The preceding spear phishing emails come from attackers using the French Yahoo and Laposte email services and possibly impersonating employees of the targeted organization.<\/p>\n

RTF Vulnerability<\/span>
\n<\/strong><\/h2>\n

These exploits target the recently discovered RTF zero-day vulnerability CVE-2014-1761. The flaw lies in the value of the \u201cListOverrideCount,\u201d which is set to 25.<\/p>\n

\"t3\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

However, according to Microsoft\u2019s RTF specifications this value should be either 1 or 9. This error eventually causes an out-of-bounds array overwrite that results in incorrect handling of the structure by Word and leads to the attacker\u2019s controlling an extended instruction pointer (EIP).<\/p>\n

Shellcode<\/b><\/span><\/h2>\n

McAfee Labs researchers discovered that all the bytes of the shellcode, the return oriented programming (ROP) chain, are directly controlled by the attacker and come straight from the RTF structure. Here is a high-level view of how the ROP chain is formed:<\/p>\n

\"t4\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Next we see a snapshot of the parsed RTF structure in memory leading to the control of the EIP:<\/p>\n

\"t5\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Successful execution of the shellcode opens the decoy document and drops the malware svohost.exe <\/b>in the %TEMP% <\/b>directory <\/b>and <\/b>then connects to the control server.<\/p>\n

\"t6\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

(McAfee Labs researchers Haifei Li and Xie Jun have already blogged<\/a>\u00a0on the technical details of the vulnerability and the shellcode.)<\/p>\n

In this cycle of spear phishing attacks we\u2019ve also seen email targeting the same organization with attachments that exploit the two-year-old CVE -2012-0158 vulnerability. The malicious payload arrives in the innocuous-sounding article.doc.<\/p>\n

\"t7\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

The following API trace gives an idea of the sequence of activities once the exploit is launched on the system:<\/p>\n

\"t8\"<\/a><\/p>\n

 <\/p>\n

Payload Analysis<\/b><\/span><\/p>\n

Our analysis of the dropped binary reveals that it was specifically written to gather information about the network of the target organization as well as the configuration of the endpoint\u2014leading us to believe that this is a spear phishing reconnaissance. The payload seems to have been compiled on April 9:<\/p>\n

\"t9\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

The malware starts by retrieving the %Temp% path and prepares to log the communication with its control server in the file %Temp%explorer.exe.<\/p>\n

\"t20\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Subsequently, the malware collecting following information:<\/p>\n