MS zero-day Word exploit (and Moscow poli-tecture)

Monday again? At least you have IT Blogwatch, in which Microsoft warns about a new zero-day Word vulnerability. Not to mention what might have been in Moscow...

Uh-oh. All aboard the vulnerability train, reports Paul Roberts: "Antivirus companies and the SANS Internet Storm Center (ISC) issued a warning today about sophisticated e-mail attacks that are using a previously unknown hole in Microsoft Word to infiltrate corporate networks ... The warning came as monitors at the ISC detailed "limited targeted attacks," originating from China and Taiwan, against an unnamed company. The attacks used Word attachments to install Trojan horse programs on corporate networks ... being used to distribute a Trojan horse called Oscor-B [or] W32/Ginwui.A ... The attacks [are part of] a series of sophisticated, very targeted attacks against large European corporations in recent months. All have used Word file attachments to install malicious programs on corporate networks. The attacks, sometimes referred to as "spear phishing" attacks, use e-mail messages that appear to come from within a company, with spoofed sender addresses and even faked corporate letterhead information. The messages are sent to employees within the company, who are tricked into opening an attachment they believe is from a colleague ... Until signatures are developed for the latest Word exploit, gateway and desktop antivirus software will not be able to detect it ... Attacks that target applications are becoming more common."

» Koon Tan writes in the ISC's Handler's Diary: "Most anti-virus vendors have already come out with signatures to detect the malware exploiting MS Word vulnerability ... At your firewall and IDS, you may want to monitor outbound traffic going to these domains, as this may be an indication of compromised hosts: 3322.org scfzf.xicp.net. If you are filtering Word attachment at your gateway, it should be based on Word file type and not just on file extension ... US CERT has released an security alert on Microsoft Word Vulnerability."

» Swa Frantzen adds: "Detection is mostly the very hard part in these attacks. This case seems to have been detected by a very alert user detecting a domainname in an email that wasn't completely right. That user detected an email coming in that originated from a domain that looked like their own, but wasn't their own (actually only had an MX record in it). The email was written to look like an internal email, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software ... This kind of attack is new, and so must the response be. The group originating these attacks does so in a very targeted fashion. The document is crafted to target a specific organization, containing specific elements that deal with just that one organization. If you don't work for them, you are very unlikely to ever see this. Proof of how rare it is, are the number of requests for samples we got from companies like anti-virus vendors."

» David Hunter: "The net is that any Word 2003 document you receive from external sources should be viewed with suspicion until Microsoft provides a fix."

» Stephen Toulouse writes from MS's SRC: "We’re hard at work on an update ... So far, this is a *very* limited attack, and most of our antivirus partners are rating this as 'low'.  But we’re working to investigate any variants we might see to make sure detection is out there, as well as working on the update to address the vulnerability."

» Winston: "A patch is being developed by Microsoft and is expected to be released on June 13th, the next scheduled patch Tuesday."

» Scott Waters calls for a quicker fix: "Don’t you feel better that Microsoft will fix this in a few weeks? There’s no mention that this particular nasty won’t effect Macs at all. But it’s still a good idea not to ever use MS Word, just to be safe and prevent any accidental loss of rational faculties that may be caused by bad software."

Buffer overflow:

    Around the Net

• ITtoolbox:  Absolute Must Read for IT Project Leaders
• Ryan Paul: Novell experiments with alternative hardware driver model for Linux
• Scott Karp: The Unbearable Lightness of 2.0 Business Strategy
• Bink: Microsoft's Windows System Reqs. 1990-2006
• Norbert Ehreke: Explicit and Implicit Metadata

    Around Computerworld

• Angela Gunn: As the IP world turns
• Frank Hayes: Reality -- what a concept!
• Mitch Betts: The two IT megatrends that really capture a CIO's attention
• Angela Gunn: Too much time on someone's hands
• Jerri Ledford: Mountains of data (and is it useful?)
• Srinivasarao Seelam: Will SAN connectivity ever be reasonable priced?
• Martin McKeay:  Blue Security gone, it's lessons already forgotten
• Eric Ogren: Microsoft Swallows the Whale
• Shark Tank: What could go wro--
• Douglas Schweitzer: Be keen on green, but careful, too!

And finally... What might have been in Moscow -- if they hadn't had second thoughts

Richi Jennings is an independent technology and marketing consultant, specializing in email, blogging, Linux, and computer security. A 20 year, cross-functional IT veteran, he is also an analyst at Ferris Research. Contact Richi at blogwatch@richi.co.uk. Also contributing to today's post: Judi Dey, our very own Antipodean.