Malicious Remote Admin Tools Make Use of Old Vulnerabilities

TORONTO—People around the world are being targeted for exploitation with malicious remote admin tools (RATs) that are taking advantage of old, already patched Microsoft vulnerabilities. That’s the finding of researchers from the Citizen Lab based at the Munk School of Global Affairs at the University of Toronto, speaking at the SecTor security conference here this week.

The Citizen Lab has been tracking the activities that nation-states, in particular China, have taken against dissidents for years.

Today a number of different techniques are being used around the world to get malicious RAT tools onto computers, according to Katie Kleemola, security analyst at the Citizen Lab. In Syria, which is currently embroiled in a bitter civil war, one of the most common ways users are being exploited is by way of fake Skype tools, Kleemola said.

The fake tools are typically presented to the user as encryption tools that will help the user stay safe from prying eyes. The irony is that the encryption tool is, in fact, the vehicle that enables an attacker to place a RAT on the user’s system.

In addition to the fake Skype tools, Kleemola said there are also fake hacking tools for conducting distributed denial-of-service (DDoS) that are being used in Syria.

Tibet

One of the key geographic areas of focus for the Citizen Lab has long been the Tibet area in China. Kleemola noted that in Tibet, the lab is mostly seeing document malware as the root to infection for a RAT.

The document malware is some form of embedded malware that executes when a user opens an infected document. For the most part, two vulnerabilities are to blame for the vast majority of document infection, she said. The first is CVE 2010-3333, which is a stack overflow flaw in Microsoft Office files that was patched in 2010. CVE 2012-0158, which is an ActiveX control flaw in Microsoft Office documents, is also being actively exploited, even though it was patched by Microsoft in 2012, Kleemola said.

Kleemola noted that there are a number of reasons why old vulnerabilities are still being exploited. For one, some people simply haven’t patched their systems. The other more insidious reason is because antivirus (AV) software is being evaded by the malware authors.

Documents, typically some form of Rich Text Format (RTF) file, can have their header information modified, which in some cases is enough to trick antivirus software into believing that the file is safe, Kleemola said. She added that antivirus vendors have been adjusting, but there is often a lag between the time a new evasion technique is discovered and when vendors have protections in place.

Macs

Seth Hardy, senior security analyst at the Citizen Lab, detailed the world of Mac RATs and exploits at the SecTor 2012 conference. Now in 2013, Hardy said the unfortunate reality is that nothing has really changed in the last year for Macs, and users are still being targeted by the same vulnerabilities.

The two key vulnerabilities that are affecting Mac users are also document related. One, CVE-2009-0563, is a stack overflow issue in Microsoft Word for Mac. The other key vulnerability is CVE 2012-0507, which is a Java-related vulnerability that was patched by Oracle in 2012.

“You would think people would have patched by now, but they haven’t,” Hardy said.

Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.