On February 1, 2018, the Korea Internet Security Center (KrCERT/CC) reported a zero-day remote code execution (RCE) exploit for the Adobe Flash Player vulnerability CVE-2018-4878 actively being used in the wild. Adobe has since published an advisory and has plans to release a patch the week of February 5.
At the moment, the attack is targeted and is limited to a specific region in East Asia. The reported attack uses a malformed Flash object embedded in a Microsoft Excel document. The same exploit can be embedded in other content that support Flash controls, including web content delivered through web browsers.
Windows Defender Antivirus detects the attack as:
- Exploit:SWF/Korpode.A (exploit code)
- Trojan:Win32/Korpode.A (dropped Trojan file)
Attack mitigations
There are several ways that this attack can be mitigated before the patch is available:
- Protected view in Microsoft Office can prevent automatic execution of the exploit.
- Attack surface reduction, a capability of Windows Defender Exploit Guard in Windows 10 Fall Creators Update, can prevent executable content from being written, injected, or launched from an Office application.
- On machines that are running previous versions of Windows, Enhanced Mitigation Experience Toolkit (EMET) attack surface reduction can help prevent Flash objects from executing. (Note that Microsoft has announced that EMET will no longer be officially supported after July 31, 2018.)
- While the patch remains unavailable, consider disabling or uninstalling Flash. Prioritize disabling Flash controls in Microsoft Office as well as web browsers, including Microsoft Edge and Internet Explorer. Enterprises can turn off Flash for Microsoft Edge and Internet Explorer using Global Policy.
Key takeaways
- The attack, which has been reported in the wild, exploits an unpatched Adobe Flash Player vulnerability.
- The exploit is a remote code execution (RCE) exploit that requires a malformed, embedded Flash object to be executed. The reported attack launches the Flash object from a Microsoft Excel document. The same exploit can be embedded in web content and launched from web browsers.
- A patch is currently unavailable—one is expected from Adobe during the week of February 5. While the patch is unavailable, apply the recommended mitigations.
For the latest updates, follow @WDSecurity on Twitter.
