Pierluigi Paganini
April 20, 2018
Security researchers at the 360 Core Security uncovered a zero-day vulnerability in IE, dubbed ‘double play’, that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.
At the time of writing the expert did not reveal the name of the APT because of ongoing investigation, most of the victims are located in ASIA.
We uncovered an IE 0day vulnerability has been embedded in malicious MS Office document, targeting limited users by a known APT actor.Details reported to MSRC @msftsecresponse
— 360 Threat Intelligence Center (@360CoreSec) April 20, 2018
According to the experts at 360 Core Security, users may get hacked by simply opening a malicious document. Hackers can use the ‘double play’ flaw to implant a backdoor Trojan and take full control over the vulnerable machine.
Through source analysis, 360 Security experts were able to discover the attack chain and reported it to Microsoft.
The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files.
This ‘double play’ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.
Experts at 360 Core Security are urgently promoting the release of the patch.
“At present, 360 is urgently promoting the release of the patch.” states 360 Core Security.
“We would like to remind users not to open any unfamiliar Office documents and use security software to protect against possible attacks.” states 360 Core Security.
Below the timeline of the zero-day:
Official Updates
Now, several equihash based mining pools have published their updates toresponse to this attack. Z-comp has changed the dependency of Equihashverify to an official authorized equihashverify (https://github.com/zencashofficial/equihashverify.git). Zencash released an official update last week: https://blog.zencash.com/update-for-the-equihash-mining-application-z-nomp/. Bitcoin Gold updated to a new equihashjs-verify. Other major crypytocurrencies and mining pools like Zclassic, BTG and Zcash also took actions to resolve the vulnerability. However, since there are many kinds of digital currencies and forked codes, smaller crypocurrencies and mining pools haven’t updated their dependencies yet. Attacks are happening at wild, 360 strongly suggest the members in the community implement the fix in time.
Solutions
Implement Zencash official solutions:
About the author 360 Core Security
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – double play zero-day, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
