2-Extended Analysis-Full

Communities @ Risk 17EXTENDED ANALYSIS: 2.1 Summary, Methodology and Data AnalysisThis low detection rate we observed isdue in part to the extensive presence ofCVE-2012-0158, which uses a number oftechniques to hide the vulnerability fromAV scanners.One of the simplest of these detectionreducingtechniques is modifying the RTFheader, since Microsoft Word will still beable to open the file, but fewer AV scannerswill detect it as malicious. Anotherbasic technique is encrypting maliciousdocument and providing a passwordto open the file in the associated email.Simply adding a password to maliciousfiles can help prevent AV detection.Since there are four ActiveX controllers—ListView,ListView2, TreeView, andTreeView2—affected by this vulnerabilityand there are no strict syntax restrictions,there can be a large variance in thedocument templates into which maliciouspayloads are inserted. These can causenewer templates to initially have lowerdetection rates.A notable technique observed was the createionof a MIME HTML (MHTML) filethat uses the vulnerable ActiveX controllers.By default, MHTML files are openedby a browser: however, they can also beopened by Microsoft Word, which willtrigger the exploit. Since Microsoft Wordmay not be the default application to openthe file, automated sandbox programsmay fail to detect the file as malicious.The older CVE-2010-3333 vulnerabilityhad similar issues with AV detection,because of the wide number of ways toencode the vulnerability. A small changein the way the vulnerability was writtencould evade signature detection whileremaining functionally the same.Although AV definitions are updated toaccount for evasion tricks, the lag betweenthe use of evasion techniques in the wildand definition updates results in temporarilylow detection rates, and hence thelikelihood of successful compromises.