lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 15 Dec 2015 20:47:47 +0000
From: Haifei Li <haifei-non-reply@...look.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
 "bugtrace@...il.com" <bugtrace@...il.com>, "bugtraq@...urityfocus.com"
 <bugtraq@...urityfocus.com>, "submissions@...ketstormsecurity.org"
 <submissions@...ketstormsecurity.org>
Subject: [FD] #BadWinmail: The "Enterprise Killer" Attack Vector in
 Microsoft Outlook

Hi All,
I have released a paper & demo describing a novel/serious attack vector I discovered in Microsoft Outlook.
Paper: https://sites.google.com/site/zerodayresearch/BadWinmail.pdfDemo: https://www.youtube.com/watch?v=ngWVbcLDPm8
Reference:https://technet.microsoft.com/en-us/library/security/ms15-131.aspxhttp://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6172
--ConclusionIn this report, the author disclosed a novel attack vector to attack Outlook users via emails, which theauthor named as BadWinmail. Specifically, we disclosed that a Flash (or other types of) exploit can bepacked and delivered via a TNEF email (or MSG attachment). The most serious impact is that the exploitwill get executed as long as the Outlook user reads/previews the attacking email. Because there is nosandbox on Outlook, it allows the attacker to take control of the victim’s computer immediately.
BadWinmail is an ideal attacking technique for targeted/APT attacks because of its severity and thenature of email-based attacks - all the attacker needs to know is the victim’s email address. It’s a “killer”exploit-delivering method as usual tricks such as delivering via email attachments or delivering via URLs(in email bodies) require additional user interactions and are protected by various applicationsandboxes. It’s also a wormable issue rarely seen on Windows platform nowadays.--
Thanks,Haifei 		 	   		  

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists