Attackers exploit unpatched Excel vulnerability
Microsoft confirms critical bug as attacks target Asian gov't offices, corporations
Computerworld - For the second time in the past five days, security researchers are warning that hackers are exploiting a critical unpatched vulnerability in widely-used software.
Attackers are exploiting a "zero-day," or unfixed, flaw in Microsoft Corp.'s popular Excel spreadsheet, using the bug to hijack select systems in Asia, many of them in government offices and high-profile corporations, said Vincent Weafer, vice president of Symantec Corp.'s security response group.
Hackers have been using another unpatched vulnerability in Adobe Reader for several weeks in a similar fashion, although now that the exploit code has gone public, experts expect to see attacks quickly increase.
The newest vulnerability, which is in all supported versions of Excel, including the latest -- Excel in Office 2007 on Windows and in Office 2008 for the Mac -- is in the program's file format, said Weafer.
"This is very similar to the Adobe [Reader] vulnerability we found earlier in that it's being used as a targeted threat," said Weafer. He said Symantec's researchers first came across attack code yesterday, and reported their findings to Microsoft the same day.
Today, Microsoft issued a security advisory with more information about the bug; that's typically a first step toward releasing a patch when a vulnerability goes public.
Microsoft spokesman Bill Sisk downplayed the threat to most users, repeating Weafer's comment that attacks have been seen in only limited numbers. But he promised that the company would patch the problem. "Microsoft is currently working to develop a security update for Microsoft Office that addresses this vulnerability and will release it after it has completed testing," he said in an e-mail.
According to Microsoft's advisory, Excel 2000, 2002, 2003 and 2007 on Windows, and Excel 2004 and 2008 on Mac OS X, are affected by the vulnerability.
Until a patch is produced, Microsoft said users could protect themselves by blocking Excel files from opening, a process that requires editing the Windows registry, normally a chore that's beyond the ability of most users. Alternately, users can run Excel 2003 documents through the Microsoft Office Isolated Conversion Environment (MOICE), a tool the company launched in 2007 that converts those files into the more-secure Office 2007 formats to strip out possible exploit code.
It's not clear how effective MOICE will be in stymieing attacks, however, since the exploit now circulating was crafted with Excel 2007 in mind, said Weafer. According to additional analysis by Symantec, the exploit works on PCs running that version of Excel but fails against earlier editions.
Hackers are using the Excel bug to deliver a Trojan horse to targeted machines, added Weaver. The Trojan acts as a downloader that is capable of retrieving and installing additional malware on the hijacked computer.
Weafer declined to draw a line between the recent zero-day dots, noting that attacks -- particularly targeted attacks like those triggering the Excel and Adobe Reader vulnerabilities -- often come in waves. But he was less hesitant to speculate on the near future.
"As soon as you talk about an [unpatched] vulnerability, people start looking at it for use in broad-based attacks," he said.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts