Abusing Microsoft Office Online Video

guest · Oct 25, 2018

Abusing Microsoft Office Online Video
October 25, 2018
https://blog.cymulate.com/abusing-microsoft-office-online-video

Cymulate’s research team has discovered a way to abuse the Online Video feature on Microsoft Word to execute malicious code (Read the press release here).

Attackers could use this for malicious purposes such as phishing, as the document will show the embedded online video with a link to YouTube, while disguising a hidden html/javascript code that will be running in the background and could potentially lead to further code execution scenarios.

This attack is carried out by embedding a video inside a Word document, editing the XML file named document.xml, replacing the video link with a crafted payload created by the attacker which opens Internet Explorer Download Manager with the embedded code execution file.
Click to expand...

guest · Nov 12, 2018

Microsoft Word Doc bug using online video feature found in wild
November 12, 2018
https://www.scmagazine.com/home/sec...bug-using-online-video-feature-found-in-wild/

Just one month after a proof of concept (PoC) was released by the research firm Cymulate showing how the online video feature in Microsoft Word can be used to deliver malware, a sample of such an attack has been found in the wild.

Trend Micro threat analysts Michael Villanueva and Toshiyuki Iwata found a sample, identified as TROJ_EXPLOIT.AOOCAI, that was spreading the URSNIF information stealer. While the basic delivery system was the same between the PoC and the in-the-wild version, some improvements were noted in the latter malware.

Cymulate has warned Microsoft of the flaw, but that firm declined to issue a CVE.

Since the flaw will not receive a patch, Trend Micro recommends blocking Word documents that has the embeddedHtml tag in their respective XML files or disabling documents with embedded video.
Click to expand...

Trend Micro Report:
Hide and Script: Inserted Malicious URLs within Office Documents’ Embedded Videos
November 12, 2018
https://blog.trendmicro.com/trendla...urls-within-office-documents-embedded-videos/

itman · Nov 12, 2018

Cymulate has warned Microsoft of the flaw, but that firm declined to issue a CVE.
Click to expand...

Log in or Sign up

Abusing Microsoft Office Online Video

guest Guest

guest Guest

itman Registered Member

Log in or Sign up

Abusing Microsoft Office Online Video

guest Guest

guest Guest

itman Registered Member

Useful Searches