Microsoft Office for Mac backdoor

Rusli

http://www.theregister.co.uk/2013/02/14/uyghur_office_for_mac_cyberspying/

 

Asian political activists whacked in Mac backdoor hack attack

 

What's up .doc? Oh, too late

By John Leyden • Get more from this author

Posted in Security, 14th February 2013 16:05 GMT

Free whitepaper – Cern and FuseSource Case Study

A security hole in Microsoft Office for Mac OS X is being exploited to hack and spy on Asian activists at odds with the Chinese government.

In the past few days, spear-phishing emails - highly targeted booby-trapped messages - were sent to Apple users in the Uyghur community, which is an ethnic group of people mostly (but not exclusively) living in Eastern and Central Asia. The community has long desired independence from Chinese rule.

 

The emails contained .doc files that exploit the MS09-027 vulnerability in Microsoft Office for Mac. That security hole allows miscreants to execute malicious code on the victim's unpatched machine if the document is opened.

Ironically, one of the files reports the “rise in possible state-sponsored hacking”. Others bear filenames including "Concerns over Uyghur People", "Uyghur Political Prisoner" and "Deported Uyghurs". If successful, the attack installs a backdoor on the compromised Apple Mac, allowing hackers to remotely control the computer and spy on its user's activities.

Last June, a batch of infected emails sent to Uyghur activists, and intercepted by security researchers at Kaspersky Lab, used a ZIP file containing a JPEG and a Mac OS X app that contained a Trojan. But the latest spear-phishing campaign attempts to exploit a Microsoft Office vulnerability that was fixed more than three years ago.

The latest attacks are explained in much more detail by Kaspersky Lab here and security tools firm AlienVault here.

Similar attacks have been hurled at other politically sensitive ethnic groups, such as the Tibetan people, and human-rights organisations for several years