Kaspersky: 70 percent of attacks now target Office vulnerabilities
Microsoft Office products are today's top target for hackers, according to attack and exploitation data gathered by Kaspersky Lab.
In a presentation at its security conference --the Security Analyst Summit-- the company said that around 70 percent of the attacks its products have detected in Q4 2018 are trying to abuse a Microsoft Office vulnerability.
That's more than four times the percentage the company was seeing two years before, in Q4 2016, when Office vulnerabilities had accounted for a meager 16 percent.
Attacks target outdated Office components
"An interesting side note," Kaspersky said. "None of the top most exploited vulnerabilities are in MS Office itself. Rather, the vulnerabilities exist in related components."
For example, two of the most exploited vulnerabilities, CVE-2017-11882 and CVE-2018-0802, impact Office's legacy Equation Editor component.
"A look at the most exploited vulnerabilities of 2018 confirms exactly that: Malware authors prefer simple, logical bugs," the company said.
"That is why the equation editor vulnerabilities CVE-2017-11882 and CVE-2018-0802 are now the most exploited bugs in MS Office. Simply put, they are reliable and work in every version of Word released in the past 17 years," researchers said. "And, most important, building an exploit for either one requires no advanced skills."
Furthermore, even if the vulnerabilities don't impact Microsoft Office and its components directly, they are exploited via Office files.
For example, CVE-2018-8174 is a bug in the Windows VBScript engine, which the Office app also uses when processing Office documents.
A similar situation is also valid for CVE-2016-0189 and CVE-2018-8373, both vulnerabilities in the Internet Explorer scripting engine that can also be exploited via Office files --where IE's scripting engine is used to process web-based content.
The same conclusions from the Office Equation Editor attacks are also valid here. These vulnerabilities exploit components that have been used in Office for many years, and removing these components would devastate Office's backward compatibility.
Recorded Future saw similar results
Furthermore, another report released last month by security firm Recorded Future also gives credence to Kaspersky's recent findings.
In a report detailing the most exploited vulnerabilities in 2018, Recorded Future ranked six Office flaws in its Top 10.
#1, #3, #5, #6, #7, and #8 are Office flaws or vulnerabilities that can be exploited with the help of Office documents.
Security research & POCS are doing harm
Kaspersky said that one of the reasons why Office bugs often become the target of malware distribution campaigns is due to an entire crime ecosystem existing around it.
Once details about an Office vulnerability become public, an exploit for it appears on the dark market in a matter of days.
"Bugs themselves have become much less complex, and sometimes a detailed write-up is all a cybercriminal needs to build a working exploit," Kaspersky said.source zdnet
- CONTRACT- Security engineer AWS | SIEM. OUTSIDE IR35
- Outside IR35
Security engineer AWS | SIEM. CONTRACT OUTSIDE IR35 Deep understanding of AWS Security (Security Hub, Guard duty, Firewall Manager etc) Extensive experience with the development, implementation, monitoring and optimisation of SIEM solutions. Experience working within a cloud migration environment. Additional key experience with Hardening, DevOps, PKI etc Financial Service experience preferred. London Outside IR 35
- Architect | Cyber Security | Public sector Permanent
Architect | Cyber Security | Public sector Permanent Seeking a Security Architect with Public Sector / Cloud Security experience for a lead technical role. Public sector security architecture design experience essential. (MoD) Current project experience delivering HLD / assurance of computer networks / build evaluations. Active Security clearance required. If you are open to hear about a new / exclusive opportunity where you are interested to be more than a number in a company reach out to team today. Chris.email@example.com 07884666351
- CIAM Architect Azure B2C
We are seeking a highly skilled and experienced Azure B2C CIAM Architect for a contract starting on Jan 2024. As an Azure B2C CIAM Architect, you will be responsible for designing, implementing, and deploying an new Azure B2C Solution . Responsibilities: Design and implement an Azure B2C-based CIAM solution that meets the needs of our clients organization. Maintain and support the Azure B2C-based CIAM solution. Provide training and support to our employees on the use of the CIAM solution. Background designing, implementing, and maintaining CIAM solutions. Experience with cloud-based identity and access management (IAM) solutions. Experience with OAuth, OpenID Connect,and SAML. Excellent written and verbal communication skills
- Senior IAM Consultant
- Upto €110,000 depending on level of position
Senior IAM Consultant is needed to help lead and deploy IAM Projects for this expand IAM Consultancy The ideal candidate will have a deep understanding of IAM concepts and technologies, as well as experience in deploying and managing complex IAM solutions. Responsibilities Lead the deployment of IAM solutions for our clients Work with clients to understand their IAM requirements and design solutions that meet their needs Configure and implement IAM solutions using best practices Integrate IAM solutions with other enterprise systems Provide training and support to clients on the use of IAM solutions Stay up-to-date on the latest IAM technologies and trends We are looking for an experieneced IAM Consutlatn with: Strong understanding of IAM concepts and technologies,including identity lifecycle management,access control,and authentication Experience in deploying and managing complex IAM solutions Experience with IAM products and solutions,such as SailPoint,One Identity Manager,and Azure Active Directory Excellent communication and interpersonal skills Ability to work independently and as part of a team Fluent in German Candidates witll need to live and have the right to work within Germany to be considered.