PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

guest · Apr 8, 2020

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack
Novel hack allows an attacker to create a mouse-over in a PowerPoint file that triggers the installation of malware
April 8, 2020
https://threatpost.com/powerpoint-weakness-mouse-over-attack/154589/

A researcher is sounding the alarm over what he believes could be a novel attack vector which allows a hacker to manipulate a PowerPoint file to download and begin the installation of malware, simply by hovering over a hypertext link.

The technique does require a victim to accept one pop-up dialogue box to run or install a program. For those reasons, Microsoft does not consider this a vulnerability. Mandar Satam, independent security researcher, disagrees.

“The attack is able to bypass the PowerPoint’s restriction of not being able to add a remote file to the HyperLink action, which if we try to add using the GUI, we can’t,” Satam told Threatpost.
“In PowerPoint it is possible to set an action on a mouse-over,” he said. "[...] we use ‘HyperLink To’ action and set it to an ‘Other file’,” the researcher wrote in a technical walkthrough of his research.
Click to expand...

Because the Hover with Power attack only triggers one pop-up dialogue box – which can be manipulated by the attacker – the researcher views this as a vulnerability. However, when he contacted the Microsoft Security Response Center (MSRC), he was told on April 2 that his inquiry would be “closed” because the attack requires an element of social engineering.

“Unfortunately, your report appears to rely on social engineering to accomplish, which does not meet the bar for security servicing… As such, this thread is being closed and no longer monitored,” MSRC wrote back to the researcher.
A Threatpost inquiry to Microsoft echoed the same.
Click to expand...

Log in or Sign up

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

guest Guest

Log in or Sign up

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

guest Guest

Useful Searches