Microsoft Spam Campaign Advisory for CVE-2017-11882

Microsoft has issued an advisory regarding new spam campaign leveraging CVE-2017-11882 in order to drop a malicious payload. Although this vulnerability was patched in November 2017, this CVE remains extremely popular with attackers due to the ease of exploitation. This most recent campaign is leveraging this vulnerability to execute malicious Powershell commands, and drop a backdoor. This campaign appears to be targeting Eastern European countries, given the languages used in the malicious emails.

Recommendations

• Enable the Cyber Attack Chatter rule and configure it to listen for chatter related to this CVE
• Apply the November 2017 Patch Tuesday security update for this CVE if not done already
• Remain alert to potential phishing attacks through email and social media

Details

CVE 2017-11882 is a remote code execution vulnerability in the Equation Editor functionality of Microsoft Office. This feature is typically used to embed and run complex equations as Object Linking and Embedding (OLE) objects, however, it lacks many of the security features of modern Office. Objects embedded with this method are run outside of Office, which makes it easy to exploit and attractive to attackers. This vulnerability is often used to automatically execute commands of an attacker’s choosing upon opening of a malicious Office or RTF file, although a patch was released in 2017.

Microsoft has issued a new advisory regarding a campaign they have observed to be exploiting this CVE. In this particular campaign, this vulnerability is being used to execute malicious Powershell commands hosted on Pastebin, and drop a backdoor on the victim machine. Malicious Office documents exploiting this CVE are attached to emails.

Email observed by Microsoft, associated with this campaign

Another email observed by Microsoft, associated with this campaign

Droppers:

ffb19eb696cc1c11b426d2c2b3ec801ba39b74d6b1772cd6fff09fecd596dd75
0bddc023f2c6c6befa1d12b1b3eaa86caa6119fd7d234d01f95bc72cc56a5eb9

Payloads:

816917f687595167f03365df571b225c36d47ec7566b10e1101575c1b30905b3
712a857b17778c6439f374ef8c02f03536f20131cbb49d7483c14b854156eada

Rambleed: A New Rowhammer Style Memory Attack

On 11 June 2019, a group of academic researchers published a website dubbed Rambleed. Rambleed is a side-channel attack technique that enables attackers to read physical memory of other processes. The attack is related to Rowhammer, which was first published in 2014, which takes advantage of flipping bits in DRAM of other processes. Unlike Rowhammer, which wrote bits to memory of processes that the current process did not own, Rambleed reads bits flipped by Rowhammer to deduce values of adjacent memory cells, thus violating process isolation boundaries.

Recommendations

• Enable the Cyber Attack Chatter rule to monitor for any Rambleed (CVE-2019-0174) related traffic on social and dark web channels
• Upgrade RAM to DDR4 with targeted row refresh (TRR) enabled

Details

This vulnerability is an expansion on the memory integrity issue of RAM as shown by the initial Rowhammer attack. By manipulating bits written into RAM, cells that hold one type of charge (bit flip off, for example) will have a higher probability of bits having an opposite charge in cells above and below it. The researchers developed "novel memory massaging" techniques that carefully place victim's secret data (such as an SSH key) in rows above and below the attacker controlled memory space, thus recovering secrets while bypassing operating system level process boundaries. According to the researchers, it took about four hours to read out enough of 2048-bit RSA encryption key, which they then recovered the rest using the Heninger-Shacham algorithm.

Breach Disclosure: Emuparadise

In April 2018, Emuparadise, a retro gaming and ROM website, suffered a data breach of their vBulletin system. An article written by ZDnet stated that the breach contained approximately 1,131,229 email addresses, usernames, IP addresses and md5 salted passwords. The website itself gained notoriety for hosting ROMs of old and retro games, and has recently switched over to only hosting emulators of these old gaming systems.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The security incident happened on or around April 2018. The databreach website dehashed originally had the data and shared it with others after a year. Although the passwords were salted, md5 is a cryptographic hash algorithm known to have weaknesses that make it much easier to brute force than modern cryptographic hash algorithms.

One user on a forum thread on epforums.org noted that "..The breach is over a year old, and as far as I can tell Emupara forces password changes every year also, so it's pretty much a non issue". Although password changes are generally good security practice, many users reuse their passwords across multiple websites, and the email addresses provide spammers and cybercriminals target lists to issue additional attacks.