Microsoft warns of Windows zero-day; hackers serve exploits in PowerPoint files
Microsoft warns of Windows zero-day; hackers serve
exploits in PowerPoint files
By Gregg Keizer
Computerworld | Oct 21, 2014 4:40 PM PT
Microsoft on Tuesday warned Windows users that cyber
criminals are exploiting a zero-day vulnerability using malicious PowerPoint
documents sent as email attachments.
In an advisory, Microsoft outlined the bug and provided a
one-click tool from its "Fixit" line that customers can use to
protect their PCs until a patch is available.
Although Microsoft does not label its advisories with the
same four-step threat scoring system it uses for security updates, it said that
a successful exploit would let hackers hijack the PC so that they could, for
example, steal information or plant other malware on the machine.
The vulnerability affects all versions of Windows, from
the aged Windows Server 2003 to the very newest Windows 8.1, and is within the
operating system's code that handles OLE (object linking and embedding)
objects. OLE is most commonly used by Microsoft Office for embedding data from
an Excel spreadsheet in, say, a Word document.
"At this time, we are aware of limited, targeted
attacks that attempt to exploit the vulnerability through Microsoft
PowerPoint," the advisory said. Other Office file types, however, could
also be used to exploit the flaw.
Ironically, Microsoft patched a similar vulnerability
last week when it issued eight updates, including one that addressed a bug in
OLE which, like Tuesday's revelation, had been exploited in the wild before a
patch was pushed to customers.
That update was designated MS14-060 by Microsoft, and was
also being exploited using malformed PowerPoint files.
According to researchers at iSight Partners, the flaw
fixed by MS14-060 had been used by a Russian hacker crew to target Ukrainian
government agencies, NATO, Western European government agencies and companies
in the telecommunications and energy sectors, since at least December 2013.
iSight slapped the moniker "Sandworm" on the cyber-spy gang.
While iSight got the credit for finding the OLE vulnerability
Microsoft patched last week, a trio of Google security engineers and a pair
from McAfee Security reported the latest bug.
Microsoft did not explicitly promise to patch the
zero-day, but it certainly will. The only question is when. Its next regularly-scheduled
Patch Tuesday is Nov. 11, or three weeks from today.
Historically, Microsoft has been hesitant to issue an
emergency security update unless attack have spread widely and affected large
numbers of customers.
In the meantime, Microsoft has crafted a Fixit tool that,
if applied, blocks the attacks seen so far.
Microsoft also urged Windows users to pay attention to
the User Account Control (UAC) pop-ups, the small alerts that require
authorization before the OS is allowed to perform certain chores, like
downloading files or running software.
UAC, which many Windows users see as an inconvenience --
and many habitually click through without a second thought -- will detect the
malformed PowerPoint file and not run its hidden malware without permission.
"In observed attacks, User Account Control (UAC)
displays a consent prompt or an elevation prompt, depending on the privileges
of the current user, before a file containing the exploit is executed,"
Microsoft's advisory said.
Comments
Post a Comment