Undocumented Word feature could lead to system information theft

Researchers have found an undocumented Microsoft Word feature that can be abused by attackers in order to obtain the system information of a victim.

The undocumented Word feature was detailed by Alexander Liskin, heuristic detection group manager; Anton Ivanov, senior malware analyst; and Andrey Kryukov, security researcher at Kaspersky Lab. A hidden feature known only as INCLUDEPICTURE was discovered by the Kaspersky team in malicious attachments contained in suspected phishing emails. The INCLUDEPICTURE field contained links formatted in Unicode, rather than the intended ASCII format, which are ignored by Word and are used by the attackers to send GET requests to malicious domains.

According to the researchers, targeted attacks using the undocumented Word feature can be very hard to detect, because the malicious documents "contained no macros, exploits or any other active content."

"A close inspection revealed that [the malicious documents] contained several links to PHP scripts located on third-party web resources. When we attempted to open these files in Microsoft Word, we found that the application addressed one of the links. As a result, the attackers received information about the software installed on the computer," the Kaspersky researchers wrote in their analysis. "This code effectively sent information about the software installed on the victim machine to the attackers, including info about which version of Microsoft Office was installed."

The researchers noted that the undocumented Word feature was present in versions of Office for Windows, iOS and Android, but said other productivity suites, like LibreOffice and OpenOffice, did not call the malicious links. The research team also noted there is no official documentation for the INCLUDEPICTURE field.

Avihai Ben-Yossef, CTO of Cymulate, said the system information theft could likely be just the first stage of an attack.

Intelligence is king in cyberattacks, as well as cyberdefense.

"[Knowing the] version of Office will allow hackers to identify whether or not the client that opened the Word document is vulnerable to known exploits that could be used to hack them. Imagine that hackers are building a database by simply sending thousands of emails to users and collecting information about those that opened the document," Ben-Yossef told SearchSecurity. "Hackers will know if their Office version is vulnerable to a specific exploit and will be able to trigger an attack when they feel like it."

Marina Kidron, head of the Skybox Security Research Lab in San Jose, Calif., said spear phishing campaigns, like the ones abusing this undocumented Word feature, may not always present an imminent threat to an organization, but this type of system information theft "could make or break a targeted attack.

"Intelligence is king in cyberattacks, as well as cyberdefense. Targeted attacks are traditionally more complex than distributed attacks, such as ransomware, because they have -- and need -- more context on the environment they're working in. With more context, attacks can be crafted to have better chances of evading detection," Kidron told SearchSecurity. "This can render signature-based intrusion detection systems ineffective and raises the importance of good cyberhygiene stalwarts, like network segmentation and vulnerability management. If an attack slips through the intrusion detection system, you need to be sure vulnerabilities with active or available exploits have been mitigated, access is limited and controls are in place to prevent the spread of the attack."