computerwoche.de

Archiv

APT attackers are increasingly using booby-trapped RTF documents, experts say

10.05.2012
Booby-trapped RTF documents are one of the most common types of malicious Microsoft Office files that are used to infect computers with advanced persistent threats (APTs), according to security researchers from Trend Micro.

"Taking data from exploit documents gathered last April, we can see that the most exploited MS Office software is MS Word," said Trend Micro senior threat researcher Ryan Flores, in a on Wednesday.

The company's statistics show that 63 percent of the malicious Microsoft Office documents intercepted in April exploited vulnerabilities in Microsoft Word.

Out of those vulnerabilities, the most commonly targeted ones were CVE-2010-3333 and CVE-2012-0158, which stem from bugs in Microsoft Word's code for parsing Rich Text Format content.

RTF content can either be saved in a document with an .rtf extension, or can be embedded into a .doc file. In fact, many malicious documents that exploited CVE-2010-3333 and CVE-2012-0158 have had a .doc extension.

The fact that the 2-year-old CVE-2010-3333 vulnerability is still widely exploited in attacks today shows that companies from many industries are failing to keep their Microsoft Office installations up to date, Flores said.