<<< Date Index >>>     <<< Thread Index >>>

Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary URL.




Discussion: Microsoft(R) PowerPoint ?Action Settings? feature allows invocation 
of default browser pointed at arbitrary URL.  PowerPoint version tested: 2002 
with SP3.

Reason for discussion:
For business reasons Microsoft(R) PowerPoint (ppt) files are allowed 
attachments in most enterprise email gateways.  This discussion is aimed at the 
need for reviewing this policy.

When configured by the slide author, the PowerPoint ?Action Settings? feature 
allows for some automatic activity.  Although this feature is not new and there 
are a number of actions that can be performed with this feature, I offer two 
scenarios of one issue.

A victim is sent an email with a Microsoft(R) PowerPoint (ppt) file containing 
a slide with a picture or object which has ?Action Settings? ?Mouse Over? 
properties configured to visit a URL.
If the victim runs the PowerPoint show and moves the mouse over the picture or 
object the default browser is launched pointing to the URL as defined by the 
slide author in the ?Action Settings: Mouse Over? properties.

Scenario 1:
Action Settings | Mouse Over | Hyperlink to: URL <malicious site>
It?s obvious there could be any malicious site pointed to here for scripting, 
spyware installation, phishing, etc.  When the victim moves the mouse pointer 
over the picture/object the page is launched using the victim?s default browser.

Mitigating factors for Scenario 1:
The victim would have to run the PowerPoint show and move the mouse over the 
picture/object.
The browser/system would need to be vulnerable to an exploit used in the script 
attack.

Scenario 2 (not thoroughly tested):
Action Settings | Mouse Over | Hyperlink to: URL 
\\<server_ip>\<share_dir>\<file>

When the victim moves the mouse pointer over the picture/object the following 
exchange occurs automatically.
An SMB NTLM challenge is sent to the victim's PC from the attacking server and 
the victim's PC will automatically respond to the challenge with an SMB NTLM 
authentication.
If the attacker is running a sniffer the victim's IP, SMB NTLM authentication 
(with the user name and password hash) is captured for future "analysis".

Mitigating factors for Scenario 2:

The victim would have to run the PowerPoint show and move the mouse over the 
picture/object.
Attacking server would have to allow incoming sessions.
The victim?s PC would have to be allowed session information over the 
network/Internet (unconfirmed).

RELATED FACTS:
*While there is a social engineering component to these attacks is not uncommon 
for recipients to open ppt files, run the show, and either use the mouse to 
click through the show or click when prompted.
*Many Microsoft(R) vulnerabilities are stamped with the mitigating factor: "An 
attacker would have no way to force users to visit a malicious Web site."
*SPAMmers are continually changing the methods used to generate traffic to 
sites.
*Spyware is a problem plaguing many organizations.

Conclusion:
With the threat of phishing schemes, SPAM, spyware, malicious scripts, and 
vulnerable browsers/systems, the policy of allowing Microsoft(R) PowerPoint 
(ppt) files to pass through email gateways should be reviewed.