Interesting Potential Attack Vector - SANS Internet Storm Center

Interesting Potential Attack Vector
One of the handlers found an interesting article on the net which raises some interesting questions and describes an interesting attack vector for the delivery of malware. Essentially it uses frames within word documents. When using frames in the document you can link the content of the frame to a URL, which will be downloaded and displayed (if relevant) when the document is opened. So this is similar to the URL links in the SPAM emails we all get. However the email links require a click, whereas this requires you to open the document. People nowadays are wary of clicking on links in emails, but will happily open a word document when it seemingly was sent by Aunty Joan, the boss, or someone else they know. So in a few minutes of thinking we came up with a number of interesting uses of this feature, ranging from tracking documents being opened to malware being downloaded and installed and of course the original use as described in the article. What to do about it? Controls on web traffic would be one defence, for example content scanning or URL blocking. The payload has to be delivered, so if web traffic is controlled the risk is reduced. To prevent email delivery, block word documents. I know a number of sites where this is the norm and it works for them. But still one of the best defences is an informed userbase, so awareness training. Other products may have similar issues, so be aware. The article can be found here. Mark Hofman ISC Handler On Duty shearwater.com.au	Mark 392 Posts ISC Handler Nov 25th 2006
Thread locked Subscribe	Nov 25th 2006 1 decade ago