Document Shell-Code Attacks on the Rise InfoWorld (05/02/07) Hines, Matt
as it appeared in the May 7, 2007 edition of ACM TechNews.
Targeted attacks that exploit vulnerabilities in popular document file formats--including Microsoft Word, Excel, PowerPoint, and Adobe PDF--and execute via hard-to-find shell code are becoming a growing threat, researchers at IBM's Internet Security Systems division have found. Experts working with the ISS X-Force group said they have noticed a rapid rise in the volume and variety of shell-code execution attacks leveled at their customers over the past year. Customers have been falling for these attacks in large numbers, the ISS division said, due to the fact that the threats typically come from spoofed email addresses that appear trustworthy and reside inside documents that do not have the same security concerns as Web-based applications. Compounding the problem is the fact that most anti-virus applications do not look for shell-code attacks, and intrusion protection systems miss many variants because the types of documents being used are harder to scan for potential threats. Microsoft and Adobe have also been finding it difficult to quickly patch the security vulnerabilities in their products, said X-Force's Kris Lamb. In an effort to correct this problem, Microsoft is working on improving its vulnerability testing process by rethinking some of the heuristics tools it uses to search for potential security vulnerabilities, according to Michael Howard, the program manager on the company's security team. Click Here to View Full Article
