New Zero-day Vulnerability Used in Targeted Attacks against Word

"A remote code execution vulnerability (CVE-2014-1761) in MS Word is currently being exploited in the wild. "At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010," said Microsoft, which acknowledged that the vulnerability also exists in Microsoft Word 2003, 2007, 2013, Word Viewer and Office for Mac 2011.

Dana Tamir, director of enterprise security at Trusteer, noted that the vulnerability can be exploited when Microsoft Word opens and parses specially crafted Rich Text Format (RTF) data. The exploit causes system memory corruption that enables the attacker to execute arbitrary code. An attacker who has successfully exploited this vulnerability could gain the same user rights as the current user.  As a result, that attacker can infect the victim's system with malware if a user simply opens the specially crafted RTF file.

The vulnerability could also be exploited through Microsoft Outlook. This is because Microsoft Word is the default email reader in most Outlook versions. In this case, previewing the message in Microsoft Outlook is enough to successfully exploit the vulnerability and download malware on the user’s machine.

A web-based scenario can also be used if the attacker creates a webpage that contains the malicious RTF-file, or if the malicious file is provided as content to websites that accept or host user-provided content or advertisements. Attackers may use this technique for conducting drive-by downloads and watering-hole attacks that infect website visitors.

Microsoft has posted a blog that discussed possible mitigations and temporary defensive strategies that can be used while the company is working on a security update.

Zero Day: A Novel

Just finished “Zero Day: A Novel,” a tale of a Cyber 9/11 managed by a wealthy Saudi jihadist who’s intent on bringing down the West. Of course, he’s fully Westernized once he leaves the Kingdom.

As in Stephen Coont’s “Hong Kong” and Winn Schwartau’s “Pearl Harbor Dot Com,” a guy with too much money and too much hate tries to take down the critical infrastructure and bring the world to its knees. This time the bad guy uses the Internet. He recruits an international team of hackers to create rootkits and others components of the payload and to launch its variations from around the world.

Written by Mark Russinovich, with a foreword by Howard Schmidt and blurb from Bill Gates, it’s a pretty good yarn of how such an attack could be successful. Basically, anyone with enough money and determination can make this happen. It doesn’t require a state actor. (If anyone needs a good reason why the Bush tax cuts should expire, it’s this: it’ll keep disgruntled or fanatical rich guys from wrecking havoc on the rest of us by reducing their discretionary income.)

The technical aspects of the plot are intriguing and well done; the rest not so much. It continually amazes me that innocents in books like this are drawn into physical violence and win. Here, the heroes move from the cyber to the physical world. After escaping an assassination attempt in New York, sanctioned by the Saudi jihadist, they fly to Moscow, where they attempt to track down the Russian author of the rootkit. He’s killed by the same Chechnyan killer who tried to nail them in NY, and who kills the hacker just as they arrive, and tries to get them again. They leave him dead outside the hacker’s apartment, along with the latter’s father-in-law for reasons you’ll have to read the book to discover.

After patching a bullet wound, they chase the hacker’s wife to Italy. When she fled, with a bullet wound to her head from the Chechnyan, she took her husband’s hard drive with the source code for the rootkits. The heroes, of course, need the code to stop the planned zero day.

The wife discovers that the Saudi had her husband killed, so borrows a gun and hops a train for Paris looking for serious payback. Hot on her trail, the heroes take a plane. They all meet—good guys and bad guys—at the Saudi’s Paris office where the inevitable drawn down takes place; not, alas, at high noon.

“Zero Day: A Novel” is very enjoyable and scarily plausible. I suspect that’s the point: to increase awareness of the threats and maybe goad people to action. I suspect, too, that it’s preaching to the choir.