this is Susan Bradley for CSO Online today I'm going to talk about the top
routinely exploited vulnerabilities and I'm gonna focus in on one particular
area that just caught my eye and I was a little bit surprised about the national
cybersecurity awareness system released this document that talked about the top
most exploited vulnerabilities between 2016 and 2019 in 2020 they talked about
cyber actors were targeting VPN applications on office 365 and various
others cyber security weaknesses but I was most interested in one in particular
back here in 2019 that I was a little bit shocked at to be honest with you and
has to do with that one right there as of December of 2019 it said Chinese
cyber actors were exploiting a twenty twelve era vulnerability can you imagine
2012 I was very surprised about that and I want to dig into it a little bit
deeper so CVE 2012 zero one five eight his bulletin ms1 to - OH - seven a very
old 2012 era patch for office 2010 this vulnerability subsidy specifically
attacks office 2003 2007 and 2010 clearly in enterprises we still use
these older office versions and we're not scanning email attachments to ensure
they're not malicious so let's dig into a little bit more of why this is so
successful in getting into our enterprises in a 2016 Sophos white paper
it discussed some of the reasons why it's so pervasive it primarily comes out
in Word and Excel and these are files that we send amongst ourselves in
business we expect them it utilizes something called Microsoft Windows
common control library this dynamic link library contains common controls such as
combo box progress bar amongst others so this particular vulnerability goes
after list view and tree view ActiveX controls it's something that we've been
using in VBA applications this vulnerability allows the attacker to
take entire control of the system so it's game over type of attack they want
to get in then the attackers found one better way to hide in rich text file
format and they found that they could pivot quite easily and evade antivirus
detection and unfortunately they also found out that word is far from
stringent from enforcing certain formations and tampered with this RTF
file format incessantly in order to confuse antivirus so they found a way to
wiggle in change there the way they look to antivirus vendors and become a direct
attack against us another issue that this patch has is a long-standing
problem we have in the patch management community we often go around a patch
that's causing issues and never go back and revisit this
I remember this patch it was hard to go and install it and it also had some
side-effects that you had to deal with if you had any third-party application
that used a visual basic application that relied upon it you had to go and
get rid of certain exd files in order to get it to work so you had to go into
certain locations documents and settings where the user name was application data
in Microsoft forms and also an app dated local temp
vbe and find these little ext file extensions and delete them so that the
application would recompile it it was a pain I remember this and as a result
many businesses went around this update and never again revisited this I
sometimes see reports on this out on the patch management org listserv where
somebody says hey I've not installed this patch because it causes this issue
and they never ever go back and revisit that issue do you know for certain that
patches that you inst skipped over back in 2012 still have the same issues today
they probably do not so it's time to go back or even review your network make
sure that you've applied everything especially to office 2010 and revisit
these older patches that you've skipped over this is actually one of the reasons
that office 2016 and the later versions of Office have what's called it click to
run platform meaning it's an all-or-nothing patching platform no
longer can you skip over an offending update you have to deal with it so if
you want to install the April release of click to run and you have issues it's an
all-or-nothing you can't go around an offending patch as an aside Microsoft
has recently introduced more changes to the click to run patching platform that
will be coming out in June I'll be covering these in an upcoming CSO online
presentation bottom line in 2020 if you still have office 2010 and deployed in
your organization re-review run your installation base to ensure that you
haven't skipped over any updates it's time to go back and review especially
now with budget tightening if you aren't planning to invest in new systems and
new software review how to best defend yourself on what you have if you still
have side effects with certain updates review the guidance out here from
Microsoft check to see known issues with Outlook Office Word you name it
use process monitor download it from this internal site and review how your
office installation is interacting with a third-party application see if you
could determine what the issue is go back to your vendors and get to the
bottom of the problems and of course right now add in user education never
open a file unless you're expecting it instruct people on these older versions
of office even in 2010 they still have what's called the mark of the web sign
up here where it says protected view this file originated from internet
location and might be unsafe warned people not to enable editing until
they're certain they know where that file came from stop think check they can
call their coworker and say hey did you send me that file don't immediately open
that file stop and think empower people to be careful and wary
especially at this time bottom line in late 2019 early 2020 where we are right
now a vintage 2012 era office patch that impacts office 2010 should not be what
the attackers are using to attack us we need to up our defenses even without
upgrading to a new version of software it's time to better protect what we
already have as always don't forget to check out the latest news on IDG tech
talk news channel until next time stay safe and get patched even on earlier and
older platforms