Microsoft Word for Mac exploit used in targeted attacks

Tibetan NGOs targeted.

Researchers at

Alienvault

have discovered a targeted attack against Tibetan NGOs that uses a three-year-old vulnerability in

Microsoft Office for Mac

.

The attack exploits vulnerability MS09-027, which was discovered and subsequently patched by

Microsoft

in 2009. On unpatched systems, a specially crafted malicious document allows for remote code execution, giving the attacker full access to the victim’s system.

The malware drops two trojans, one of which – ‘MacControl’ – was hitherto unknown and listens for commands from a command and control server.

The attack is not the first of its kind targeting Tibetan organisations and many believe the attackers are based in or have links with China. Indeed, the MacControl command and control server is hosted on a Chinese IP address.

Alienvault

has more details on the attack

here

.

Trend Micro

recently wrote about a similar attack

here

.

Is your organisation vulnerable to targeted attacks? How seriously do you take the security of your Macs? Symantec.cloud’s Martin Lee will discuss patterns and trends in targeted attacks at the

VB seminar

, while Sophos’s Paul Baccas will talk about Mac security.

The VB seminar takes place 19 April 2012 at the OU Campus in Milton Keynes, UK.

Posted on 28 March 2012 by

Virus Bulletin