Microsoft Office for Mac backdoor
Asian political activists whacked in Mac backdoor hack attack
What's up .doc? Oh, too late
By John Leyden • Get more from this author
Posted in Security, 14th February 2013 16:05 GMT
Free whitepaper – Cern and FuseSource Case Study
A security hole in Microsoft Office for Mac OS X is being exploited to hack and spy on Asian activists at odds with the Chinese government.
In the past few days, spear-phishing emails - highly targeted booby-trapped messages - were sent to Apple users in the Uyghur community, which is an ethnic group of people mostly (but not exclusively) living in Eastern and Central Asia. The community has long desired independence from Chinese rule.
The emails contained .doc files that exploit the MS09-027 vulnerability in Microsoft Office for Mac. That security hole allows miscreants to execute malicious code on the victim's unpatched machine if the document is opened.
Ironically, one of the files reports the “rise in possible state-sponsored hacking”. Others bear filenames including "Concerns over Uyghur People", "Uyghur Political Prisoner" and "Deported Uyghurs". If successful, the attack installs a backdoor on the compromised Apple Mac, allowing hackers to remotely control the computer and spy on its user's activities.
Last June, a batch of infected emails sent to Uyghur activists, and intercepted by security researchers at Kaspersky Lab, used a ZIP file containing a JPEG and a Mac OS X app that contained a Trojan. But the latest spear-phishing campaign attempts to exploit a Microsoft Office vulnerability that was fixed more than three years ago.
The latest attacks are explained in much more detail by Kaspersky Lab here and security tools firm AlienVault here.
Similar attacks have been hurled at other politically sensitive ethnic groups, such as the Tibetan people, and human-rights organisations for several years