Third attack hits Microsoft Word

Tailored attacks on the increase

This month no less than three sets of targeted, focused attacks using newly discovered vulnerabilities in Microsoft Word were found in the wild. These attacks are reflective of two growing trends ? first the increase in the number of criminals targeting Windows, specifically MS Office, file formats. Suffice it to say, Office documents represent a great breeding ground for such attacks. They provide rich functionality, enabling linked content and actions inside a normal document, and on the human side they represent a great social engineering vector. Indications show that hundreds of such attacks are lurking in Office, and are being slowly revealed by hackers, who are doing their own research. The second trend is that attacks are increasingly very targeted and very specific. In these cases, the attacker appears to profile the organization and carefully craft a few messages (and documents) to select a handful of individuals ? often to great effect. Targeting specific individuals, is often the most efficient way to obtain sought after, sensitive information. Also, the tailored nature of the messages means that the victim is more likely to open it and thus launch the exploit. As fewer messages are being sent they are less likely to be detected and in most cases the perpetrators aren?t using stock malware. All of this is designed to avoid signature-based detection. These sophisticated, tailored attacks are on the increase and are the work of determined adversaries and a rise in financially motivated cyber crime. To combat this threat to both their employees and resources, organisations need to understand all the paths can that lead to sensitive data and must implement technology that analyzes the patterns of behaviour on an enterprise network so it can quickly detect and react to anomalies as they occur, identifying and reacting to threats before it is too late.

Posted by: Jose Nazario, Arbor Networks 20 Dec 2006