Category Archives: MS Office

AKBuilder: A builder for exploit-laden Word documents

Posted on by

One doesn’t have to be a great coder to become a successful cybercriminal, as underground markets are filled with offerings that automate one or another step of an attack chain. Take for example the AKBuilder, a builder for Word documents that carry exploits for several vulnerabilities and a malicious, encrypted payload. The evolution of AKBuilder According to SophosLabs principal researcher Gábor Szappanos, two versions of the builder have, at one time or another, found their … More → Continue reading AKBuilder: A builder for exploit-laden Word documents→

Post-pumpkin Patch Tuesday: What’s in store for November

Posted on by

There has been a lot of activity since October’s Patch Tuesday. During that short period of time, Oracle released its quarterly CPU, including an update for Java JRE; Adobe resolved a zero-day in Flash Player; a security researcher identified a new form of attack called Atombombing, and there has been some rising discussion around the Server 2016 servicing model. The week following Patch Tuesday, the week of October 17th, Oracle released its quarterly CPU, resolving … More → Continue reading Post-pumpkin Patch Tuesday: What’s in store for November→

October Patch Tuesday: Changes, urgent updates and what’s coming next

Posted on by

The leaves aren’t the only things changing this October. Patch Tuesday is here and with it comes some interesting updates from big names in the software space. This month, Microsoft implemented Servicing Model changes, Adobe changed distribution of Adobe Flash and announced this will be the last month of updates for the ESR branch of Flash Player, and in the next week or so, Oracle will reveal its Quarterly Critical Patch Update. What changed this … More → Continue reading October Patch Tuesday: Changes, urgent updates and what’s coming next→

Microsoft ends Tuesday patches

Posted on by

Yesterday was a big day for Patch Tuesday. It was the last traditional Windows Patch Tuesday as Microsoft is moving to a new patching release model. In the future, patches will be bundled together and users will no longer be able to pick and choose which updates to install. Furthermore, these new ‘monthly update packs’ will be combined, so for instance, the November update will include all the patches from October as well. We have … More → Continue reading Microsoft ends Tuesday patches→

Macro-based malware evolves to bypass traditional defenses

Posted on by

Macro-based malware is growing into full-featured malware capable of detecting and bypassing traditional security tools, Barkly researchers have discovered. Macro-based malware: The past Malware peddlers have been misusing Word macros to deliver malware for nearly fifteen years. The approach, which takes advantage of the macros’ capability to automatically execute a series of instructions as a single command, has initially been used in the early 2000s. As users became accustomed to it, this malware delivery tactic … More → Continue reading Macro-based malware evolves to bypass traditional defenses→

Latest Flash 0day exploit delivered via booby-trapped Office file

Posted on by

Four days have passed since Adobe patched the latest Flash Player 0day vulnerability exploited in attacks in the wild and, in the meantime, we have been given more details about the attacks and the exploit used. Genwei Jiang, the FireEye researcher who has been credited, along with several others, with the discovery of the flaw (CVE-2016-4117), says that the initial attacks were leveraged against targets running Windows and Microsoft Office. “Attackers had embedded the Flash … More → Continue reading Latest Flash 0day exploit delivered via booby-trapped Office file→

Microsoft releases eight critical updates

Posted on by

Microsoft has released its May patch updates and it was a rather large deployment with 16 total updates this month. The critical versus important updates were split down the middle with eight important and eight critical. Most of the critical are remote code execution, which is a commonly the end result of exploits. The biggest difference this month from April? We didn’t see anything compared to the Badlock fiasco, but critical patches are still critical … More → Continue reading Microsoft releases eight critical updates→

How to block malicious macros for good?

Posted on by

Microsoft is finally doing something about the increasing threat of malicious macros: it has added a new feature in Office 2016 that will block macros from loading in certain scenarios. “Recent data from our Office 365 Advanced Threat Protection service indicates 98% of Office-targeted threats use macros,” the company noted. “The enduring appeal for macro-based malware appears to rely on a victim’s likelihood to enable macros.” With this new feature users will be unable to … More → Continue reading How to block malicious macros for good?→