MS Word Zero-Day Exploit Found

From Slashdot

Quote:

---

MS Word Zero-Day Exploit Found

Posted by Zonk on Friday May 19, @02:37PM
from the don't-do-any-work-today dept.
subbers writes "A zero-day flaw in Microsoft Word program is being used in an active exploit by sophisticated hackers in China and Taiwan, according to warnings from anti-virus researchers. The exploit arrives as an ordinary Microsoft Word document attachment to an e-mail and drops a backdoor with rootkit features when the document is opened and the previously unknown vulnerability is triggered. From the article: 'The e-mail was written to look like an internal e-mail, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software.'"

---

Slashdot Link: http://it.slashdot.org/it/06/05/19/1718203.shtml

Also in ISC:

ISC Link: http://isc.sans.org/diary.php?storyid=1346

Annnd from FSecure (from the ISC text):

Quote:

---

Summary

Ginwui is a fully-featured backdoor with rootkit features. This backdoor was distributed inside a document file with a shell-code that dropped the backdoor's file to a hard drive and activated it.

Detailed Description

The shell-code in the Word document decrypts and drops the backdoor's file as CSRSE.EXE to the temporary folder and activates it.

After being run the dropped file in its turn extracts and drops another file to a system. This file is dropped as WINGUIS.DLL to Windows System folder and its DoHook function is activated by the dropper. The dropper then deletes itself from a system.

The dropped DLL file is the main backdoor component. It traps several functions and modifies information that is passed to a user. As a result the backdoor's file, startup key in the Registry and process are not visible to a user.

The backdoor creates a startup key for its file in the Registry:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = "%WinSysDir%\winguis.dll"

where %WinSysDir% represents Windows System folder which by default has the C:\Windows\System32\ name.

Being active the backdoor connects to specified address in order to receive commands from a hacker. The backdoor allows a hacker to do any of the following on an infected computer:

-> create, read, write, delete and search for files and directories
-> access and modify the Registry
-> manipulate services
-> tart and kill processes
-> take screenshots
-> enumerate open windows
-> create its own application window
-> get information about infected computer
-> lock, restart or shutdown Windows
-> create a pipe and read files from it

start a remote command shell
enumerate network resources

The backdoor also creates 3 empty SYS files in the \drivers\ subfolder of Windows System folder.

...
..
.

Write-up: Alexey Podrezov, May 19, 2006

Technical Details: Alexey Podrezov, May 19, 2006

---

FSecure Link: http://www.f-secure.com/v-descs/ginwui_a.shtml

I'm sure there will be more to follow on this...

Good!

*sigh*

Another new user who can't read the FAQ.

:rolleyes:

Hmmmm,

I wonder if anti-malware applications that protect the Registry would thwart this one?

Something like RegistryProt:

http://www.diamondcs.com.au/index.php?page=products

There are a variety of other freebies on this site if you fancy a browse.

:)

Quote:

---

The exploit arrives as an ordinary Microsoft Word document attachment to an e-mail...

---

Seems I haven't heard much about Word Exploits in awhile so I'd bet many will fall for this even if it's the same ole toon - attachments.

As suggested a little change control might be in order. Wonder if Scotty would work as RegistryPort might?

cheers

Hi Relyt

Yes he will, I run both at the same time (have done for years :D ) and it is interesting as to which one warns you first.

I realise that I am probably in a minority, but I have believed in the Registry protection approach ever since I figured out that most crap tries to alter the Registry.

OK, it isn't any good for your granny or Joe Soap, as they wouldn't understand the question, but I have deployed Scotty on a lot of people's boxes and it seems to work. I just explain that if they update software or install something new they will get warnings. If they are just using the computer as normal then there shouldn't be any.

I also like the "sandbox" concept (hey that goes back to Berkley and the beginnings of Unix, if not before?) for e-mail and IM.

:)

EDIT: Sorry "Scotty" is WinPatrol: http://www.winpatrol.com

Quote:

---

Originally posted here by nihil
Hmmmm,

I wonder if anti-malware applications that protect the Registry would thwart this one?

Something like RegistryProt:

http://www.diamondcs.com.au/index.php?page=products

There are a variety of other freebies on this site if you fancy a browse.

:)

---

Another nice one which you may not of heard of which acts as an intrusion prevent system for windows and which is also free is: Prevx

Due to the overwhelmingly popular response to my "Good!" comment, I have decided to release an actual post. Also, **** you for not just ignoring it like a mature person (on that note, **** me for not ignoring you like a mature person). Practice good security, communicate with the sender via a trusted channel to confirm that they sent you the email and the attachment.

Quote:

---

Also, **** you for not just ignoring it like a mature person (on that note, **** me for not ignoring you like a mature person).

---

Hi SicWitt,
I hope this will be helpful advice. In the future, if you don't like a particular software program or vendor, please give reasons for your opinion in a logical, well thought out manner. Usually, one word posts add little to a discussion and are highly susceptible to being misinterpreted. I hope your future association with AO will be productive and fruitful. I look forward to learning from your posts.

Quote:

---

I think you are an idiot Phalse. Keep track of your ****. Do you have a "phone home" on TV and in all your books, pencils, and clothing? Hell no. If you responded to this question with a technical answer... wow.

---

Hmm, a little more expansive, but not quiet what I was thinking of. I'm afraid if you keep this up your time on site will be short.

Quote:

---

Hi SicWitt,
I hope this will be helpful advice. In the future, if you don't like a particular software program or vendor, please give reasons for your opinion in a logical, well thought out manner. Usually, one word posts add little to a discussion and are highly susceptible to being misinterpreted. I hope your future association with AO will be productive and fruitful. I look forward to learning from your posts.

---

... Self righeous *****.

Quote:

---

... Self righeous *****.

---

I probably am. And if not for God's grace, I would be a lot worse :) Still, I think you should take my advice.

Well I am glad that I do not phase you preacher. Perhaps when you post advice you should be a little less nice because it really does make you look self-righeous. ^_^

I often find that those who use the term "self righteous" are in themselves self worshipping. Viewing their actions as holy and wholesome in their own introvertional congregation of piety.

Ok to get this thread back on topic, I've got a question...

How have you folks in the IT arena responded to this threat?
Have you stopped allowing Word docs in via Internet email?
What if anything have you adjusted?

Unfortunately my users are admins on their respective desktops/laptops so I've had to block Word docs from coming into our environment via Internet email. Making many people :mad: as you can imagine.

Curious about your response to this.

Quote:

---

How have you folks in the IT arena responded to this threat?
Have you stopped allowing Word docs in via Internet email?
What if anything have you adjusted?

---

One example response... Mcafee DAT 4766 detects the exploit. Quick report of the enterprise compliance level shows most clients with DAT 4667, those that did not show at least 4766 were force updated. In addition the gateway can detect the exploit through Group Shield and on the educational front users were "warned" about doc files coming in. I also did a quick scan of the information store and there were no detections. Since there were no detections blocking .doc attachments would have a serious impact on operations that wouldn't weigh with the actual threat. So with these other tools in place I will not block doc attachments at this time and will watch closely for variants. If I did choose to block them I would have someone monitor files that are getting blocked. Also if there wasn't a valid need to have .doc files coming in I would have blocked them by now.

I noticed the article only mentioned office 200. But it makes me wonder if you could preform the same exploit in office 2003. Taking it a step further, if you could exploit the feature rich setting that allows user to use Word 2k3 for all message creation in Outlook.

Hi RC:

Thanks for response. I just removed the filters because, like you did, our McAfee DATs detect the exploit and our PCs are up-to-date, and there doesnt seem to be much 'chatter' about other victims or wide spread attacks. We just needed to quarantine things until all clients were updated.

So we'll be monitoring the situation closely.

For anyone who is not receiving Microsoft's Security update newletter

Quote:

---

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: May 22, 2006

********************************************************************



Security Advisories Updated or Released Today

==============================================



* Microsoft Security Advisory (919637)

- Title: Vulnerability in Word Could Allow Remote

Code Execution

- http://www.microsoft.com/technet/sec...ry/919637.mspx

- Revision Note: Advisory Published: May 22, 2006

---

Read it for yourself but here is the over view from technet

Quote:

---

Microsoft is investigating new public reports of limited “zero-day” attacks using a vulnerability in Microsoft Word XP and Microsoft Word 2003. In order for this attack to be carried out, a user must first open a malicious Word document attached to an e-mail or otherwise provided to them by an attacker. Microsoft will continue to investigate the public reports to help provide additional guidance for customers as necessary.

Microsoft is completing development of a security update for Microsoft Word that addresses this vulnerability. The security update is now being finalized through testing to ensure quality and application compatibility and is on schedule to be released as part of the June security updates on June 13, 2006, or sooner as warranted.

Microsoft is concerned that this new report of a vulnerability in Word was not disclosed responsibly, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.

---

Most of the larger A/V firms (Symantec, McAfee, Trend, Kaspersky...etc) already have signatures in place to catch/block the malicious files.

A contributor of Securiteam's website wrote the following as an interesting layered approach to prevent infection via applying a Software Restriction Policy:

Quote:

---

Windows XP users have a little-used weapon that they can use to blunt the effect of the in-the-wild malicious code targeting this vulnerability: software restriction policies. By using the “Basic User” SRP, users can launch Microsoft Word without the ability to write to certain registry and file system locations that the in-the-wild malware requires access to. This is a stop-gap measure based on the threat profile of the in-the-wild malware at this time and is only necessary if you’re still running interactively as an administrator. If you are, it should be a priority to change that if at all possible.

I’ve produced a simple registry script that sets a Software Restriction Policy that runs any instance of ‘winword.exe’ with the ‘Basic User’ policy. Once the registry script has been imported, the SRP can be rolled back (if desired) via the Security Policy snap-in.

---

The full article can be found here

He also offers a link to the registry script that will modify the Security Policy.

*just an update, might as well share some of this info with the rest of you*
If you are running any of the following hardware firewalls that include A/V services, you should be protected: Checkpoint, Fortinet, CiscoASA, Aladdin Esafe

Couldn't get ahold of anyone at Watchguard or Sonicwall to find out if their A/V sigs protect against this vuln or not and their site did not provide anything useful....especially sonicwalls - last virus update notification was oct 05 *winces*