Microsoft patches serious Word bug targeted by scammers

Microsoft-Word

An attacker can make a user download malicious word file as an email attachment, execute codes, and install malware on victim's system. Researchers from security firms McAfee and FireEye warned that the malicious Word documents are being attached to e-mails, but didn't reveal the scope or ultimate objective of the campaign.

In this case, it's a Word document that contains an embedded exploit.

Instead, the vulnerability is triggered when a victim opens a trick Word document, which downloads a malicious HTML application from a server, disguised to look like a Rich Text document file as a decoy.

The.hta file is executed automatically, allowing the attackers to gain full code execution on the machine, downloading additional payloads from "different well-known malware families".

But the post does say that the exploit takes advantage of OLE - and even that might be useful to a would-be attacker looking to duplicate it, said Allen.

Microsoft confirmed it is planning to fix the issue in a patch set to be released with its scheduled monthly update on Tuesday.

More news: Playing political poker with bridge tolls
More news: ADB sees growth moderating to 6.4%
More news: Pearl Jam, Tupac, Yes, Journey to be inducted into Rock Hall

The advice of not opening files from the people you don't know is not really that helpful for employees working with scanned documents on a daily basis in a business environment, where they regularly have to open scanned documents and Word files from unknown (potential) business partners. "Customers who applied the update, or have automatic updates enabled, are already protected", said a Microsoft spokesperson.

Microsoft said the bug affects all supported versions of Office, and some versions of Windows.

According to McAfee, the files used by attackers were organized as Word files, but the exploit works on all versions of Microsoft Office, including Office 2016 running on Windows 10, which is supposedly the safest Windows version.

Both McAfee and FireEye noted that the exploit can bypass most memory-based mitigations included in Windows. However, it's not rare for such attacks to happen on larger populations once the underlying zero-day vulnerability becomes public knowledge. The first observed attack was in late January, noted Li.

Users should not open any Office files obtained from "untrusted locations".

"According to our tests, this active attack can not bypass the Office Protected View, so we suggest everyone ensure that Office Protected View is enabled". Also, the attack can not bypass the Protected View in Word, so McAfee suggested enabling this view mode when opening documents just to be sure.

Related:

  • Windows Vista is officially dead

    Windows Vista is officially dead

    So, if security issues weren't enough to get you to consider a newer version of Windows, the problem of incompatibility might be. For those who remember way back when, Vista was supposed to be the next great version of the Windows operating system.

    North Korea fires ballistic missile into its eastern waters

    A U.S. statement said initial assessments indicate the type of missile was a KN-15 medium-range ballistic missile. "We have no further comment", Secretary of State Rex Tillerson said in a statement.
    Flynn made $1.3 million for lobbying, speeches, other work

    Flynn made $1.3 million for lobbying, speeches, other work

    A National Security Council aide is reportedly behind a White House leak that is roiling Congress and the Trump administration. Flynn reported assets worth between $1.2 million and $2.4 million during the a year ago .
  • Hungary should talk with Soros-founded school

    Hungary should talk with Soros-founded school

    Protesters filling Kossuth Square outside Parliament said they want President Janos Ader to veto the legislation. The protesters said they wanted to convince Ader to reject the bill and refer it for constitutional review.
    Apple is developing in-house power management chips, German analyst reports

    Apple is developing in-house power management chips, German analyst reports

    It would mean Apple calling time on its existing arrangement with Dialog Semiconductor, which makes chips for existing iPhones. Apple hired several Imagination employees before news broke of the company's plans to sever ties with the firm.
    A Trump national security adviser tapped as Singapore envoy

    A Trump national security adviser tapped as Singapore envoy

    That authority led to last week's removal of senior adviser Steve Bannon from the council's principals committee. Powell joined the White House to work with Trump daughter Ivanka on women's empowerment issues.
  • Glum Wenger counts cost of Arsenal's latest defeat

    The last time the north London outfit lost four league away matches in a row came in 1995 under the management of Stewart Houston. I've managed over a thousand games for Arsenal Football Club and we are not used to it, so of course it's a big worry".

    Salute to Chuck Berry opens Rock Hall ceremony

    ELO - who kicked off the show with Berry's "Roll Over Beethoven" - and progressive British rockers Yes were also inducted Friday. Perry, estranged from the band for many years, did embrace guitarist and co-founder Neal Schon onstage.

    North Korea says Syria airstrikes prove its nukes justified

    The comments were made by a Foreign Ministry official and carried Sunday by North Korea's state-run Korean Central News Agency. Despite the criticism from Moscow, U.S.
  • ARMS and Splatoon 2 Nintendo Direct on Wednesday 12th

    ARMS and Splatoon 2 Nintendo Direct on Wednesday 12th

    The arena-based fighting game utilizes motion controls, where players choose between different classes for unique attacks. The amount of these rewards hasn't been revealed, nor has Nintendo revealed the platform at the center of these bounties.
    Prince George and Princess Charlotte join aunt Pippa Middleton's bridal party

    Prince George and Princess Charlotte join aunt Pippa Middleton's bridal party

    But royal author Judy Wade says it's quite unlikely that Kate Middleton will have a prominent role in Pippa's wedding. Pippa reportedly has a strict " no ring, no bring " policy, which means guests can only bring spouses as a plus one.
    United States  disappointed by Russia's reaction to its airstrike on Syrian airbase - Tillerson

    United States disappointed by Russia's reaction to its airstrike on Syrian airbase - Tillerson

    We don't even know who's bombing us, we are just being bombed. "This regime should be ousted from leading Syria at once". Embassy in the Turkish capital of Ankara to protest Friday's U.S. missile strike on a Syrian air base.

Comments

Latest news

New 'Thor: Ragnarok' Trailer - It's Thor vs. Hulk!
However, Bank's "stolen style" joke doesn't really make any sense because Hela's always had her dark green look in the comics. She then blows him to oblivion, showing the extent of her power as she overthrows Asgard with her sheer prowess.

Ailing Josh Donaldson not starting in Blue Jays' home opener
Now in addition to the quiet bats, there is some concern with Donaldson who pulled up with a sore calf on Sunday in Tampa. Marco Estrada took his first loss of the season giving up 5 earned runs on 7 hits while striking out 5 over 5 innings.

New York Set to Make State College Tuition Free for Middle Class
The scholarship is structured to fill in the gap after accounting for other federal and state grants. That income cap will be raised to $110,000 by the end of next year and $125,000 by 2019.

Trump tells newspaper Obama aide might have broken the law
Senior intelligence agency officials then decide whether that information can be provided without violating the legal guidelines . In a New York Times interview published Wednesday afternoon, Trump again accused someone of a crime, citing zero evidence.

USA, Mexico & Canada Announce Joint Bid for 2026 World Cup
Soccer president explained the rationale behind having Canada and Mexico join the Americans' bid for the 2026 World Cup . While the bid is being branded as being from all three countries, it clearly favours the United States.

Sunderland stay rooted to the bottom after United defeat
Sunderland will consider an appeal against Larsson's dismissal with Moyes convinced his midfielder was harshly treated. Zlatan Ibrahimovic put United 1-0 up on 30 minutes before Seb Larsson was sent off for a high tackle on Ander Herrera.

RSS chief Mohan Bhagwat wants cow slaughter ban across India
The RSS chief, however, admitted that India's diversity makes it hard to implement a uniform law across the country. However, he condemned violence by cow protection groups as it "defames" the cause.

'Mowgli girl' found living with monkeys in Indian jungle
Ajay Deep Singh, district magistrate of Bahraich, had visited the hospital three days ago and dubbed her "Van Durga". A Hindustan Times report said the little girl, 10, was shifted to a shelter home for the disabled in Lucknow.

Vladimir Putin meets French far-right candidate Marine Le Pen in Moscow
Le Pen, leader of the National Front party, said she and Putin discussed ways to fight "fundamentalism". On Friday, Marine Le Pen visited Moscow and met with Russian President Vladimir Putin in the Kremlin.

Arab leaders ready to work with Trump on Mideast peace deal
Five former Lebanese presidents and prime ministers aroused the ire of Hezbollah and its supporters this week for penning a. Trump has since invited Abbas to the White House, a meeting Abbas said he expects to take place in late April or early May.

Ibrahimovic inspiration keeps Man United in top-four race
Asked about their situation, he said: "It's still as hard - probably more hard because there's a game less". It is the way it works and I am from the old generation, which I think was more like that.

Congress seen as not likely to pass tax overhaul quickly
They have formed a coalition - called Americans for Affordable Products - and launched an all-out campaign to kill the proposal . Because the tax is such a significant departure from the current system, many lawmakers from both parties are wary of it.

Fed minutes reveal debate over inflation and Trump
Greenbrier, which makes railroad freight vehicle equipment, announced a bigger profit and better sales than analysts expected . Yields on 10-year paper came right back to 2.33 per cent, threatening a hugely important chart barrier at 2.30 per cent.

Nvidia Titan Xp is the new-new king of graphics cards
This card goes for $699 and and offers performance that's almost on par with that of the more expensive Titan X . It also has much faster memory than the Quadro, bumping up from the 10GHz of last year's Titan to 11.4Ghz.

Uber strikes back against Waymo's lawsuit over alleged stolen trade secrets
Also on Thursday, the judge said he'd allow experts chosen by Waymo to examine Uber's technology to check for stolen design. The problem about this is, at that time, Levandowski was still under the employment contract of Waymo .

Other news