Kaspersky: 70 percent of attacks now target Office vulnerabilities
Microsoft Office products are today's top target for hackers, according to attack and exploitation data gathered by Kaspersky Lab.
In a presentation at its security conference --the Security Analyst Summit-- the company said that around 70 percent of the attacks its products have detected in Q4 2018 are trying to abuse a Microsoft Office vulnerability.
That's more than four times the percentage the company was seeing two years before, in Q4 2016, when Office vulnerabilities had accounted for a meager 16 percent.
Attacks target outdated Office components
"An interesting side note," Kaspersky said. "None of the top most exploited vulnerabilities are in MS Office itself. Rather, the vulnerabilities exist in related components."
For example, two of the most exploited vulnerabilities, CVE-2017-11882 and CVE-2018-0802, impact Office's legacy Equation Editor component.
"A look at the most exploited vulnerabilities of 2018 confirms exactly that: Malware authors prefer simple, logical bugs," the company said.
"That is why the equation editor vulnerabilities CVE-2017-11882 and CVE-2018-0802 are now the most exploited bugs in MS Office. Simply put, they are reliable and work in every version of Word released in the past 17 years," researchers said. "And, most important, building an exploit for either one requires no advanced skills."
Furthermore, even if the vulnerabilities don't impact Microsoft Office and its components directly, they are exploited via Office files.
For example, CVE-2018-8174 is a bug in the Windows VBScript engine, which the Office app also uses when processing Office documents.
A similar situation is also valid for CVE-2016-0189 and CVE-2018-8373, both vulnerabilities in the Internet Explorer scripting engine that can also be exploited via Office files --where IE's scripting engine is used to process web-based content.
The same conclusions from the Office Equation Editor attacks are also valid here. These vulnerabilities exploit components that have been used in Office for many years, and removing these components would devastate Office's backward compatibility.
Recorded Future saw similar results
Furthermore, another report released last month by security firm Recorded Future also gives credence to Kaspersky's recent findings.
In a report detailing the most exploited vulnerabilities in 2018, Recorded Future ranked six Office flaws in its Top 10.
#1, #3, #5, #6, #7, and #8 are Office flaws or vulnerabilities that can be exploited with the help of Office documents.
Security research & POCS are doing harm
Kaspersky said that one of the reasons why Office bugs often become the target of malware distribution campaigns is due to an entire crime ecosystem existing around it.
Once details about an Office vulnerability become public, an exploit for it appears on the dark market in a matter of days.
"Bugs themselves have become much less complex, and sometimes a detailed write-up is all a cybercriminal needs to build a working exploit," Kaspersky said.source zdnet
- SailPoint Integration Consultant
- Upto £75000 plus benefits
SailPoint Integration Consultant. SailPoint Integration Consultant is needed for this expanding service business to help them with complex deployment with their FTSE focused customer base. They are looking for experienced SailPoint Integration Consultants who have: • Strong solution designing experience with in depth understanding of IAM concepts and thorough understanding of Sailpoint domain. • Thorough understanding of Identity and Access Governance concepts • Leading and creating Identity & Access Management (IAM) technical architecture • Secure by Design principles in Identify Access management, Privilege Access management • Familiar with cloud architectures, data management and source control from a security perspective. This is a great opportunity to join a business that is growing and looking for individuals who want to grow and develop and work on some of the most complex Sailpoint deployments.
- CyberArk Integration Consultant
- Greater London
- upto 75,000 plus benefits
CyberArk Integration Consultant. CyberArk Integration Consultant is needed for this expanding service business to help them with complex deployment with their FTSE focused customer base. They are looking for experienced CyberArk Integration Consultants who have: • Strong solution designing experience with in depth understanding of IAM concepts and thorough understanding of CyberArk domain. • Thorough understanding of Identity and Access Governance concepts • Leading and creating Identity & Access Management (IAM) technical architecture • Secure by Design principles in Identify Access management, Privilege Access management • Familiar with cloud architectures, data management and source control from a security perspective. This is a great opportunity to join a business that is growing and looking for individuals who want to grow and develop and work on some of the most complex CyberArk deployments.
- Penetration Tester, UK based. Ability to achieve SC clearance
- United Kingdom
Experienced Penetration tester- UK based with the ability to achieve SC clearance. On-going training and development and paid certifications / renewals. Interested to hear from all areas of penetration testing, web app, infrastructure, mobile, etc. MUST have current hands on experience delivering penetration testing. Ideally from a consultancy background with experience working with multiple clients. OSCP / CREST / CHECK / Tigerscheme penetration testing experience / certifications desirable. Apply today for more details. All information kept in the strictest of confidence.
- Senior Data Privacy Specialist, London. CIPT
REF CH7875 £60,000 Senior Data Privacy Specialist, London. CIPT Senior Data Privacy Specialist needed to help advise client on project and programmes relating to Data Privacy and compliance. UK based role. Ideally looking for someone that has a strong appreciation of technology and Data Privacy that can work with clients to develop or enhance their strategies, policies, processes and techniques to manage cybersecurity risks while enabling business driven data. Certified Information Privacy Technologists (CIPT), Certified Information Privacy Professional/Europe CIPP/E experience and or certification highly desirable. Specific experience within the healthcare industry is of particular interest. All details kept in confidence Apply today for more information