Download presentation
Presentation is loading. Please wait.
Published byGordon Taylor Modified over 9 years ago
2
Attacks Using Malicious Hangul Word Processor Documents Jaebyung Yoon @ KrCERT/CC
3
Introduction of HWP Hangul( 한 / 글 ) : Word Processor of Hancom Inc. HWP is a filename extension and abbreviation of Hangul Word Processor The latest version is Hangul 2014 for Windows, Hangul 2008 for Linux, and Hangul 2006 for Mac OS X The first version is 0.9 in 1989
4
2 byte language Word Processor Other Asian Word Processors Ichitaro – Japanese Word ProcessorNJStar – Chinese Word Processor
5
First Generation (~1999, HWP 3.0) Second Generation (2000~, HWP 5.0) History of Hangul
6
Save a Local SW Maker (The New York Times, 1999) History of Hangul
7
Hangul Sales Composition Hancom sales composition Office S/W Market Share
8
Hangul supports the special needs of Korean written language especially government’s needs. De facto format especially in Korean government, military and public education. Government officer receives a lot of e-mails attached HWP file EVERYDAY. Attackers also knew this circumstance so they has researched the HWP document format as well as software vulnerabilities for a long time. Stature of Hangul in Korea
9
Can not tell malicious or not before open The contents of malicious document is related with recipient’s business. Malicious HWP Composed of vulnerability part, exploit part, malware part and normal document part. Malicious HWP Document
10
Composition of malicious document ④ Malware part ① Vulnerability part ② Exploit Part MALWARE.exe
11
OLE (Object Linking and Embedding) HWP Document Format
12
Streams of Bodytext storage are loaded File structure and memory layout – Exploit tremendous size in document Heap Spray EB 08 = jmp (here+0x08)
13
Normal case (two tmp files) Malicious case (normal document(hwp.hwp), ~AB.tmp, msloger.exe, tmp.dat) On document loading (tmp files)
14
Hwp.exe process is not opened by user but ~AB.tmp. ~AB.tmp Malware Action 1
15
System information leakage from compromised PC Malware Action 2
16
Use of Malware Information leakage Document leakage Security bypass Remote desktop Key logger, System information HWP, DOCX Vaccine, firewall Team Viewer
17
Document Content and social issue CONTEN TS ISSUE
18
Keyword of Document Korean War National Security Defense Policy Korea Air force Future War territorial dispute Dokdo Peace of Korean peninsula Armistice 60 years Military New product research Wage Contract Personal Information Protection Act Energy forum Enterprise leadership contacts SAMSUNG Tax audit Movie news The public North Korea and China Kim Jong-un reunification Ministry of unification Nuclear Unification forum North Korea Strategies refugees North Korea Foreign policy Asia issue Park Geun-hye East Asia Ministry Key pledge Unified Progressive Party Policy foreign News China visit economic union Next government Policy recommen dation Gov’t How to be loved by wife election pledge Takeshima LG
19
Scenario of malicious document attack Government. Military Organization ① Spear phishing mail ② Open document ③ Information leakage ④ Information gathering Attacker Compromised E-mail account
20
Attack feature Use Email account like C&C Use document as decoy Use normal program as malware to avoid detection Use Zero-day Vulnerability Persistent Attack
21
Use email as command and control Attack feature Mail address & account info. example.com bb@example.com aa@example.com id : name pw : pass bb@example.com aa@example.com id : name pw : pass example.com Malware delivery & info. leakage Final destination - attacker’s account Sign in send malware from to Hardcoded in malware
22
Information flow through email Attack feature Sent Leaked Information from compromised PC
23
Use zero-day vulnerability About 15% of malicious documents use zero-day vulnerability. Finding zero-day and making exploit are not easy. Must understand HWP document format Own tools to exploit → They have researched the document format and software Only Korea Unlike doc & pdf, HWP is used in Korea only It means opportunity cost is very high Attack feature
24
A team not a person - guessing Attack feature Issue & Target Monitoring Team Social issue monitoring Document Contents search Gathering target person email Vulnerability Research Team Document Format Research Software Vulnerability Research Malware Team Making malware Manage C&C Manage email account
25
Since Oct. 2012 Hancom office, Gom player, NateON Vulnerability (2013, 179 cases) Especially HWP zero-day Response - KrCERT/CC Vulnerability Reward Program
26
Secure Coding in software design step Detect Abnormal section data and don’t load to memory Response - Vendor (Hancom) New version of Hancom office (2014) -Detect and protect of malicious document -Enhanced Secure coding
27
Software User MUST Update ALL software MUST use Vaccine Take care before opening attached file in email Vendor Introduce secure coding Rapid respond for vulnerability Effort to make users update CERT or security company Make pattern to detect malicious document Share the vulnerability information Response - Conclusion
28
Thank you jbyoon@krcert.or.kr
Similar presentations
© 2024 SlidePlayer.com Inc.
All rights reserved.