Outlook Vulnerability

An exploit has been released for a cross site scripting vulnerability in Microsoft Outlook for Android. A flaw in the way Outlook parses emails can be abused in order to execute arbitrary code on victim device. A researcher from F5 labs has published a blog post containing technical details related to the vulnerability. Microsoft has released a patch for this exploit.

Recommendations

• Apply the patch for CVE-2019-1105 listed on the linked advisory.
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this vulnerability.

Details

On June 20, 2019, Microsoft disclosed a vulnerability in the email parsing mechanism of Outlook for Android, CVE-2019-1105. Successful exploitation of this could potentially allow for an attacker to conduct cross site scripting attacks on victim devices. At the time of Microsoft's advisory release, limited information regarding the vulnerability was available. However, over the weekend, a researcher at F5 Networks, Bryan Appleby, released a blog post containing a proof of concept of an exploit and further technical details.

In the post, Brian describes how Outlook for Android allows for iframes to be embedded in an email. This allows for JavaScript to be embedded in an email, and run directly on an affected device that receives an email exploiting this CVE. When an attacker sends a malicious email, the server escapes JavaScript that is contained within the iframe, so it is never seen. When a malicious email is received, the client unescapes the JavaScript, and runs it. Because of this, an attacker is able to leverage this vulnerability in order to execute arbitrary JavaScript on a victim device with ease.

Breach Disclosure: Social Engineered

On June 24th, ZD Net published that the forum Social Engineered was breached on June 13th of this year. Social Engineered is a forum dedicated to discussions about social engineering. The breach affected the data of 89,000 users by exposing their email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes. A solution has been implemented to prevent a repeat of the data breach by becoming a commercial forum, rather than remaining free and open-source.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Social Engineered was running on a free open-source software that is used to create and maintain forums, called myBB. This software contained a bug where malicious Javascript could be sent to an administrator or published on a forum in order to gain full access to the targeted account. This vulnerability was patched by MyBB in version 1.8.21, on June 10th. The forum Administrator disclosed in a post on the platform that because of the vulnerability in MyBB, Social Engineered would be using Xenforo software rather than MyBB. Any users of this forum should immediately change their passwords, as it is likely that their account has been compromised.

MacOSX Gatekeeper Vulnerability

Researchers have found a new variant of malware in the wild which takes advantage of an unpatched vulnerability in OSX. Specifically, the vulnerability exists in Gatekeeper, the software responsible for rejecting unsigned, unknown applications. The attackers found that by creating a symlink to the malicious software and convincing the end user to execute the sym-linked binary, that the protections of Gatekeeper could be completely bypassed. In order for this attack to take place on a victim's computer, the attacker still must convince the victim to download and execute code.

• Only download software from trusted sources.
• Watch out for a Mac OSX patch for MacOS X version <= 10.14.5.

Details

On June 20, 2019, Threatpost reported that researchers came across a never-before-seen malware which allows an attacker to bypass MacOS X's Gatekeeper software. Gatekeeper is used to verify the authenticity of a binary and to prevent an end user from executing untrusted software. Originally, the flaw was discovered and disclosed to Apple giving them a 90 day window to fix the bug. Since Apple did not fix the bug in a timely manner, researchers released the proof-of-concept which exploits the Gatekeeper flaw. In order to execute untrusted code, the attacker creates a symlink to a malicious file. When that file is executed, it bypasses Gatekeeper's security and executes the malicious code. Researchers have observed this attack taking place in symlinks in Zip files as well as disk images. Currently, despite the fact that the malware samples were found in the wild, the nascence of the samples discovered hints that the attackers are still developing an exploit against this vulnerability.

New Method of Achieving Code Execution in Microsoft Excel

Dynamic Data Exchange, or DDE, attacks have remained popular since their initial disclosure in October 2017. A new method of using DDE objects to load external objects without user interaction has been discovered by researchers at Mimecase. This method, which involves abusing the Power Query feature, could potentially be used to drop secondary malware or execute arbitrary commands on a victim machine. No patch is available, however, Microsoft has released mitigation guidelines.

Recommendations

• Consider enabling the cyber chatter rule to monitor activity related to this vulnerability.
• Apply the mitigation techniques recommended by Microsoft for this and other DDE related vulnerabilities.

Details

Researchers at Mimecast have discovered a new method for embedding remote payloads in Microsoft Excel documents. This method exploits a Dynamic Data Exchange (DDE) feature called Power Query, in order to load externally hosted malicious content with an Excel document. DDE was initially intended to exchange data between operating systems and applications, however, attackers often abuse it as a way to achieve macro-less code execution within a malicious Office file. This new version of the exploit could potentially be used to drop additional malware on a victim device, or even to fingerprint a device or sandbox. These researchers have released a proof of concept and further technical details in their blog post. Although Mimecast coordinated disclosure with Microsoft, Microsoft has declined to release a fix for this issue, and instead recommends their mitigation techniques for DDE related attacks be applied.