take your seats please actually always
want to know a little bit more about
exploits and I think this could be an
interesting presentation about that
Chintan the room is yours okay
so in this session we are basically
going to talk about the static analysis
methods for production of Microsoft
Office exploits a quick introduction of
the speaker
I kind of have 14 years of experience
when network security industry currently
working with McAfee IPS research team
and passionate about researching
targeted attacks covered multiple of
them in the past encode multiple rocket
attacks with the government organization
in the past work with them as well and I
I primarily focus on fuzzing quality
research imagining exploits and
developing detection solutions for
McAfee products and second times we
could add Virus Bulletin thanks to the
organizing team to give this opportunity
so the agenda of for today will be I'll
just quickly walk walk you through the
office threat landscape and a quick walk
through to the vulnerabilities exploited
and in the middle of the session I'll
give up give us suggestions or
suggestions to detect the Microsoft
Office exploits what kind of static
analysis can be used over the Microsoft
Office exploit Microsoft Office files
without much of the much without
worrying much about the unabated details
and we'll talk about the supervised
learning for macro classification and to
the end ends of end of the session I'll
briefly go through the block diagram of
the engine which is implemented which
has been tested over the wider set of
exploits and will conclude this session
with the initial results that we saw
over over the exploits that we tested so
this slide just covers some of the
prominent Microsoft Office threats that
we found
that we had over the past few years and
which basically signifies on how
Microsoft Office threat says has evolved
over the past few years and has been
exploited in the wild right so this are
some of the exploits which has been used
in targeted attacks and has been very
very significant in in in in their
impact so this is sourced out of
Kaspersky earlier this year which
basically just describes the the shift
the significant shift in the in the
tagging at that tiger at platform so we
see that in in 2015-16 time frame
browsers where were kind of targeted the
most and later half of later 2018 and
probably during the early 2019 70% of
the exploits were targeted towards the
Microsoft Office so there was
significant shift to to the targeted
platform quickly going through the evil
own abilities exploited so what types of
Fullerton page that is exploited in
Microsoft Office prominently they are
passed parsing engine flaws which which
prominent it predominantly relates to
the RTF filters so RTF is is is most of
you would have seen it is pretty complex
structure with with lot of nested
formatting controls right there there
are controls to perform at format your
text format your paragraphs and from at
your images videos embedding objects in
lot of lot of them right so it is pretty
complex structure and it is multiple it
has multiple control words parsing
vulnerabilities which has been reported
in the past and so espero specifications
Microsoft RTF specs there are more than
800 control words which which out of
which it is largely unexplored so there
could be more more parsing mullah
liberties so probably the this this
floss has has been very significant
scripting engine flaws is has been
exploited
largely so I scripting engine can can
also be exploited in
the office files right because both of
them use the same sintering scripting
engine the scripting vulnerabilities
engine milimiters will be common between
ien office holy exploits which is a
massive attack vector it has been
exploited most of most of the exploits
which have which has been which which we
have found in the past are well related
to early feature of office so there are
kind of multiple things here one is
linking other is emitting where linking
is basically you link to the external
file which is either to the disk or it
can be an external file so by and large
the linking relates to the remote code
download pros execute we have seen
multiple such experts in the past right
le to link exploit and other object
object linking exploits which has been
exploited which has been out there
embedded embedding primarily leads to
the memory corruption exploits or it can
also be a container exploit where the
embedded embedded document or embedded
object can be used to aid further
exploitation right for example it could
be used to aid a it would be used to
perform a mitigation bypass or it could
be used to manipulate the process heap
static analysis for genetic detection so
primarily what we need is is robust
document parser which can extract
embedded objects and streams and it
should be able to handle the streams and
document structure office caissons which
we have which which are kind of pretty
significant in the exploits we this
office occations can can make the
analysis pretty difficult if you see the
office caissons in RTF file format they
are kind of pretty nested control words
and it it would make the the reverse
engineering very difficult but
apparently the office RTF parcel engine
microsoft RTF parser engine can handle
this kind of office questions pretty
pretty well that's so these an attack
cars basically use his office case
and primarily try to misguide the RTF
parsers or try to mislead the the
analyst the focus here is focus of the
static analysis engine is to detect upon
eyes exploits which which basically uses
auxilary methods and it doesn't worry
about the vulnerability details but it
family focuses on detecting malicious
code embedded inside either hidden or or
apparently visible payload inside the
embedded objects and object streams it
is coded to it is basically designed to
detect the containerized exploits
extraction of embedded exploit embedded
documents and then again forwarding
feedback doing a feed back to the same
analysis engine to reanalyze the
extracted document and pointers of the
external code so going to the risk rich
text format so what kind of methods can
be used to analyze a rich text format
files so probably one of one of the
static analysis heuristic is is the
control words parsing so we can see the
control words are larger in number and
and they have certain parameter and they
take that they take a data which could
be either binary or which could be
simple numeric parameter or which could
be a binary data so in this control
worlds destination control words are a
sort of special interest towards lesson
in control words are basically those
which which takes the stream of binary
data and there are very less
restrictions on what kind of data that
that that you can store into this
control words right and there are more
than thousand of them so you can see in
the left there are a whole lot of
control words which can consume consume
data and and apparently because of that
the data streams can be embedded the
streams that is embedded in this control
word scan can be either either a shell
code either can be either a malicious
executables or can be office cater to
break the immature parsers right so and
as an example there are a couple of
exploits which which embed for example a
pea fragments exploit which which
a shell code inside the as a part of the
control board data and only on the Left
left-hand side the upper left-hand side
there's another control board called
level text control board which which was
very heavily used in targeted attacks
which was known as RDF exploits having
shell code inside the control board data
right so what do we do with the static
analysis we need a parser which can
extract this this control word streams
and this control words this value each
other when it is extracted it it needs
to be scanned for for any malicious
indicators right so this can prominently
detect many of the auxiliary strategies
that that an exploit can have one of the
example is a datastore control word
which which is in R T which is an RTF
control board which was very heavily
used to embed the office credit or X or
executable in one of the previous
exploits that was massively used in
targeted attacks so very critical to to
analyze this control word parameters
next is the overlay data streams so
overlay data is is pretty simple concept
it is it is basically the data which is
appended at the end of the file
RTF rendering engines usually will
ignore this data while processing but
many many rdf exploits we have been able
to locate in the past which can which
can embed the additional data at the end
of the file so if you see a couple of
exploits as an example which have shown
shown here 1:15 164 one which embedded
embedded 380 KB of data which which had
multiple stage multi stage its shellcode
and then the core document which was
stored at the end of the file next is is
one of the more recent exploits where
around 180 KB over 8 190 KB of data was
appended at the end of the RTF file so
very very important to do extract this
overlay data and analyze it further so
what should we do here
is simple units tickets to look at the
end of the file and almost always the
larger volume of avila data is almost
always suspicious to to the almost
always suspicious so in our testing we
have basically tested a couple of few
thousands of exploits having overlay
overlay data and we've we've found that
RTF files with a wallet data more than
300 bytes ninety-three more than ante
three percent of that of that kind of
files are are found to be suspicious
in fact malicious as per as per the
protections so pretty interesting
auxillary strategy which is which has
been used in RTF exploits lately really
is as I as I said it's a massive attack
vector which has been abused very very
heavily in the recent past
so this early is is the object control
word which is the the object data is is
is a parameter to this object control
word and which is kind of stasis the the
format of the data is really safe to
stream in the only 1.0 native native
stream format and when the when the
object is embedded it there are kind of
certain modifiers to this control board
which which is obj a MB or obj auto link
which is which which indicates either
the object is embedded or the object is
linked right so the advantage of that is
that the advantage of this this kind of
exploit is is it is very easy to
implement it is very easy to target
target the victims and there is there is
no no complex exploit which is required
basically no memory corruption exploit
which is required to execute this
strategy so recent trends has been
largely to do a remote code download
in work respective handlers it could be
either MSHDA hand or it could be WSDL
handler and then it could be a HT a HTML
handlers in work respective handlers and
then do a remote code execute so your
code could be sitting anywhere outside
your anywhere in to the external server
and then you can basically just link
your object to that external code and
then download and execute which is
pretty simple to target victims now as
an example as an example the red mark
basically indicates the RTF control word
structure you can see the the
destination control word is used as an
object which is accompanied with obj
auto link and then which a class which
is a class of the only object which is
kind of document dot eight with mottling
so if you see this this this combination
of control words and and the embedded
object obj auto link with what document
dot eight or dot well could be used
where this basically indicates that the
word that the document is linked to this
container act right now this document
could could be either in your disk or it
could be sitting anywhere to the X it
could be anywhere external so this this
is stored you know you know willie 1.0
native stream format the format of the
or unitive native stream is is described
in the specifications like it basically
describes whether the object is either
linked or either embedded there so
basically this this green highlight is
is the either linked object header or
embedded object header and the parameter
to this to this obj data which which i
was mentioned mentioning earlier is the
overlay 2.0 compound document stream so
what we essentially need to do is is
while looking at the RTF documents for
for any malicious indicators we need to
basically look at the object control
word parts the obj data and extract the
parameters to this obj data so this
we extract seem to stream to this OB
generator will basically we are
essentially extracting this worry to
compound document so as an example one
of the previous exploits which had
malicious code embedded within the
linked object so you can see this le 1.0
native stream which which had a
multi-stage cell shell code and then the
static analysis engine was able to
extract this stream and look for the
malicious indicator so engine basically
was able to detect the malicious code
out of embedded within this stream so
pretty critical to to analyze this obj
data streams so by enlarge this is how
the parsing in the static analysis
engine works if we if you look at the
RTF file RTF file analysis in the in the
engine implementer engine it basically
takes care of the overlay data analysis
over data for any malicious indicators
it could be shellcode it to be
executables it could be office gated
streams it would be X or keys it could
be scripts and the normally control
words which which is indicated as other
control words with data streams it could
be either data store control word it
could be the theme data where you know
the the XML file format can also be
embedded very important and the upper
block larger block indicates the early
inspection so only instruction can be
parameters to this object control words
it could be either obj EMB it could be
either auto linked with word or document
dot 813 and only packages now only
packages can also have scripts embedded
within within within that you could have
executables within that it could have
linked to the external point external
source code as I was as I was mentioning
earlier it could be a pointer to the
external code so once you extract this
the streams so engine basically extracts
this already 1.0 native stream and it
will look for either a 2.0 compound
document which was which is a previous
format
which is a little odd zero format so
when it finds that it will from it will
forward it to CFP analyzer CFP analyzer
will basically parse the storage streams
will extract the storage streams and it
will basically look for any malicious
indicators on the other path if it also
looks for the Oh XML documents embedded
or XML documents can either be used to
bypass the windows medications it could
be used to load the suspiciously load
the comma objects which we'll see later
on a few minutes later and then it
basically scans the embedded ActiveX
control for indicator so this is
basically how the prominently the RTF
parsing in the engine works so all the
open XML format some other some of the
heuristics which which the engine
implements is multicom loading detection
so multi-count loading as you probably
would know that it was significant it
was heavily used method to bypass the
windows medications like SLR and and and
read execution prevention and it it was
predominantly used to aid the further
exploitation but we have seen exploits
which which embed a XML document within
RTF and RTF document is basically used
as a container to this Oh XML and just
link to the u XML document so when you
just open the RTF document it will
basically probably the dialog box
whether and ask you to update the OH XML
document now this update can happen even
when your document is store somewhere
outside right on CNC server or somewhere
in somewhere external externally located
so if you see here the chrome object has
been loaded multiple times now this is
pretty suspicious activity as far as the
loading of the car object is done now if
you see here the experience exploitation
strategy is prominently we're loading
single object multiple times
loading fake objects using non-existent
silicide is this this second thing
was primarily done to reduce the to
improve the expert performance and to
consume lesser time when when you are
you doing manipulation of meant when you
are basically spraying the heap or doing
process
manipulation keep an ablation so as I
said RTF was a container for XML
exploits primarily used to bypass
windows mitigations so there's this is
one one exploitation strategy which
which is implemented in the static
analysis engine to detect suspicious
comm loading methods and what do we do
in the in the XML file now when we
extract our XML file either embedded in
the RTF document or submitted separately
analysis engine will basically look for
multiple things it will look for ActiveX
directory look for embeddings directory
embedding selector is pretty critical in
terms of embedding overly objects now
that only objects could as I said it
could be either executable payload it
could be either only packages it could
be either externally located code or it
could be any any parsing any object
embedded inside the XML file which could
exploit a parsing vulnerability right so
as an example 117 1 w18 26 when the
analyzer they extracted the streams it
was able to locate the malicious code
inside so primarily this has been the
focus now Oh XML we also need to need to
do the stream analysis where we also
check for supplemental techniques
supplemental techniques could be
malicious binary streams and that could
either be sledges or it could be either
drop chains or it could be their shell
codes or it could be anything
so engine on the left side if you if you
observe it it has extracted the Rob
chain very very accurately so we analyze
we analyze so static analysis engine
basically analyzes the streams and tries
to tries to apply some guessing and
validation algorithm to to locate this
Rob chain
next on the compound binary file format
as as as we know and it is basically
well documented that compound binary
file format is primarily hierarchical
storage streams hierarchical file format
where the there are root storage objects
and there are there are stream objects
and root root storage object so any
parser which analyzes this file format
needs to be able to extract this object
and storage streams and particularly
what is interesting interesting section
of compound binary file file format when
we do the analysis is the object pool
storage so that's that's where we found
that most of the shell codes most of the
malicious code and and and other other
malicious streams are are located so
very critical to analyze the obj info
plus ocx data so CX data is family the
stream where the le o le data is is is
located and the macro where the macro
basically resides in the vba storage
object so as an example the the analyzer
extracts all the object and storage
streams within the compound binary file
format and and you can see the one of
the recent exploits down 18 4 8 7 8
where the malicious content object
stream was having the having the code
embedded so it is very very important to
have this this generic analyzed analysis
implemented inside the engine another
example where the the PowerPoint
PowerPoint exploit was having the
malicious code embedded inside the
PowerPoint document stream objects so
any it is it is significant to it is
very very important to analyze and ex
extract analyze all the streams but
particularly as I said the holy stream
is is primarily of interest
so supervised learning from macro
classification so we did some
experiments with multiple ml algorithms
the storage is as I said in in Microsoft
compound binary file format the storage
is inside the VBA storage stream root
storage stream and inside the dir and
will be a project where the most of the
macro code resides well in the Oh XML
it's basically in VA project bin if you
unzip the XML file format and locate
this VBA project ID bin file which is
again the early to format so need two
parts the whenever there is an overly to
format you need to parse the early to
format and then extract the streams out
of that so so supervised learning
multiple methods tested basically random
forests and and KNN primarily and we
found that decision tree was working
very well in terms of prediction so
prediction any nine percent of the
prediction where where we found that it
was able to 99 percent of the times we
have were able to see the correct
prediction so this is the partial
decision tree plot where we used lot of
features more than 100 macro features
which we constructed out of which we
constructed a decision tree and then we
tested on around 10k samples sample set
initially and we found that 99% of the
time it was the correct prediction so
implementation of the engine at a high
level it it looks like this
so finally submitted to the to the to
the engine and after checking the input
file type basically either it goes to
CFG analyzer it goes to RTF analyzer it
goes to XML eliezer and each analyzer
will have a separate module for for
analysis for example RDF analyzer has
has the embedded object analysis
shellcode detection overlaid our
detection control words analysis
and extraction of world of xml documents
and then further analyzing it to either
determine the malicious indicators so
all of these were basically implemented
in the in the in the engine so to
conclude this presentation we will will
share some of the results with you so
initial results were basically targeted
towards the exploits that were used
heavily used in the in the targeted
attacks and with minimal set of exploits
we were able to achieve around nineteen
nineteen ninety-one percent of addiction
rate in some cases even more than that
with with some of the generic detection
implemented as we as as I mentioned
earlier so this this is at a high level
what what what we observed when we
tested on some of the high impact
exploits most of them we we tested
against the targeted attack exploits
using targeted attacks because we we
used to get this either in our sample DB
or you know either
violet elementary data and then we
primarily achieved around 91 91 percent
of detection in some cases even more
than that so this was the initial
results that's it
any questions