Speaker 1: Produced by Pimedia. Hi, I'm Raan Levy. Welcome to CP Radio.
Speaker 1: A year ago, this podcast re recounted one of the
Speaker 1: most momentous decisions in cybersecurity history. It concerned one of
Speaker 1: those most inedible images known to computer users. Every a
Speaker 1: button from Microsoft programs like Word and Excel security warning,
Speaker 1: our computers would read macros have been disabled, and then
Speaker 1: there was an option for you to click to enable content.
Speaker 1: The option to enable macros was always a tricky one.
Speaker 1: A small sect of power users really loved using macros
Speaker 1: to streamline and automate the various ways they used Microsoft products.
Speaker 1: The vast majority of us never used them though, or
Speaker 1: probably even knew what macro were, So when we opened
Speaker 1: files and were presented with the option to enable macros,
Speaker 1: we often just hit okay because we didn't know better.
Speaker 1: But there is a problem with defaulting two okay. We've
Speaker 1: known this for years, and even though Microsoft has fixed
Speaker 1: their problem, we're still suffering as a result of this instinct. Today,
Speaker 1: consider the fox It pdf reader. When it comes to
Speaker 1: PDF viewing software, Adobe Acrobat Reader is clearly top dog.
Speaker 1: It's probably what you use, but among its competition, Fox
Speaker 1: sit Reader is a significant player. It's got over seven
Speaker 1: hundred million users spread across two hundred countries. Among its
Speaker 1: customers are high level government entities like the US Air Force, Army,
Speaker 1: and Navy, and major cooperations Morgan Stanley, Amazon, and Microsoft,
Speaker 1: to name just a few. The widespread popularity of fox
Speaker 1: seat reader makes see it extra crucial that no subtle
Speaker 1: security flawers end up sleeping past notice. That's why Anthony
Speaker 1: Sterefo's reverse engineer at Checkpoint Research recently tested fox it
Speaker 1: in x mon and Exploited Detection and Analytics tool for
Speaker 1: detecting zero day exploits.
Speaker 2: We got a notification from x mored, which is like
Speaker 2: a vulnerability kind of sundbox. I would call it with
Speaker 2: a triggered like a malicious behavior on a PDF file.
Speaker 2: Once we saw that the dynamic analysis of the PDF
Speaker 2: was triggering like a malicious command, I started analyzing it statically.
Speaker 2: So I used some tools that are for static analysis
Speaker 2: of the PDFs, like PDFs Analyze.
Speaker 1: The issue. It turned out was deeper than just one
Speaker 1: malicious threat. Say you're using fox it to open up
Speaker 1: a PDF file you don't know is malicious, you'll initially
Speaker 1: get a pop up. Some features have been disabled to
Speaker 1: avoid potential security risks. Only enable these features. If you
Speaker 1: trust this document, then you get two options. Trust this
Speaker 1: document one time only or always. So far, so good.
Speaker 1: But with the pdf Antonis who was looking at Once
Speaker 1: he made his choice, he got a second message asking
Speaker 1: largely the same thing, but in more words, it went
Speaker 1: something like, the file may contain programs, macros or viruses
Speaker 1: that could potentially cause damage to your computer. Only open
Speaker 1: the file when you are sure it is safe, and
Speaker 1: so on again. Here there are two options open and
Speaker 1: do not open.
Speaker 2: The problem in this case is that Foxy Prider is
Speaker 2: a creating a SOLVB pop up messages that by the
Speaker 2: fault once you click there, like the default opsio provides
Speaker 2: you a malicious activity.
Speaker 1: How many of us are going to read the first
Speaker 1: pop up let alone the second nearly identical one, Maybe
Speaker 1: if you're being attentive, but not if you're busy, distracted,
Speaker 1: or just lazy. You just want to click through, and
Speaker 1: the options available aren't presented equally for your lazy brain.
Speaker 1: The open button is highlighted in blue as if it's
Speaker 1: just beckoning you to click.
Speaker 2: It, so it has all default top show like even
Speaker 2: if you don't read that all the pop up messages
Speaker 2: and you just click in it. You are going to
Speaker 2: execute the malicious command. And this is what the threat
Speaker 2: actors were taking that one that's off.
Speaker 1: Think of this not as a software exploit, but a
Speaker 1: human one. A design flaw that allowed a threat actor
Speaker 1: to more easily fish their victims by getting them to
Speaker 1: click the button that would enable their malicious behavior, and
Speaker 1: all of this without the hacker having to trick the
Speaker 1: victim in any way or do any work at all.
Speaker 1: The program is built to get people to click the
Speaker 1: button that causes their demise on its own. Though this
Speaker 1: isn't the end of the world, it only starts to
Speaker 1: become a problem in the context of broader fishing attacks.
Speaker 2: I remembered there was one tactle that was kind of
Speaker 2: an interesting one that was using a malicious PDIA file.
Speaker 1: The file didn't contain any kind of exploit that triggered
Speaker 1: upon clicking okay. Rather, it included a hyperlink that directed
Speaker 1: victims to a second attachment.
Speaker 2: And then it was downloading from Trello, which is legalityimate
Speaker 2: the website.
Speaker 1: Hosting malicious activity on legitimate popular sites like Trello proved
Speaker 1: useful it meant that browsers and Internet traffic monitors wouldn't
Speaker 1: think twice if a victim visited and clicked on the
Speaker 1: attached file.
Speaker 2: A PDF with a fox It vulnerability, and then it
Speaker 2: was executing like a command line, a power cell command.
Speaker 1: By the end of this attacker's chain of events from
Speaker 1: the foxheit PDF, the user downloads remcoss.
Speaker 2: Red It's like a remote access Troyan which can perform
Speaker 2: all kind of like activities like get access to the
Speaker 2: computer of the victim, like a few sensitive files, upload
Speaker 2: sensitive files, further infect the system, still even credentials as
Speaker 2: far as I know, and takes crinslets of the computer.
Speaker 1: This particular threat actor, dating back to March first, seemed
Speaker 1: to be exploiting fox It in Southeast Asian countries like
Speaker 1: Korea and Vietnam. As Anthonys and his colleagues looked into
Speaker 1: this threat though, it only became bigger. Operating under the
Speaker 1: moniker at sid and killer TV, an individual claiming to
Speaker 1: be an ethical hacker with more than twenty two years
Speaker 1: of experience, had been selling a number of malicious tools
Speaker 1: on Telegram since twenty twenty two. As of April twenty seventh,
Speaker 1: one of them was a foxed reader exploit. The malicious
Speaker 1: program boasted of quote one hundred percent bypass with anti viruses,
Speaker 1: plus Gmail, Yahoo, Facebook, and Hotmail file sharing restrictions, which
Speaker 1: sounds fake, which you'd hope is fake.
Speaker 2: Most of the places, like the Gmail Facebook, when you
Speaker 2: set a fight, if it's unleasius, they are going to
Speaker 2: trigger for example, if it's unexecutable, it's going to trigger
Speaker 2: a warning or is not even going to allow you
Speaker 2: to sell that file to the coddact that you are
Speaker 2: trying to send it. But with this word ability, everything
Speaker 2: was bypassed. Gmail was not able to the deck, like
Speaker 2: Facebook was not able to detect Silent Killer.
Speaker 1: TV's exploits really could bypass traditional security checks in major
Speaker 1: social media and mail platforms, but it wasn't because his
Speaker 1: malicious code was so amazing and sophisticated.
Speaker 2: In the majority of the cases, theerability was never prickered
Speaker 2: because everyone was using Adobe.
Speaker 1: Cybersecurity researchers have a set of tools they typically used
Speaker 1: to investigate threats, like anti virus and sandboxes. Anthony's found
Speaker 1: that his all used Adobe Reader to open PDFs by default.
Speaker 2: If you are trying to exploit a specific software like
Speaker 2: fox It, you'll need to have it in your soundbox
Speaker 2: and execute samples with that software. With Foxy, but if
Speaker 2: the majority of the sandboxes are using Adobe, we never SeeAbility.
Speaker 1: Exploits happened to scart past analysts radars because of this
Speaker 1: simple quirk in their sandby only x Man that program
Speaker 1: we mentioned the beginning of the show ran Anthony's PDF
Speaker 1: files in both the Adobe and Foxed viewers. This might
Speaker 1: explain why after some further investigation, Antonisili's colleagues found so
Speaker 1: many other thread actors exploiting fox It instead of its
Speaker 1: more popular alternative Adobe. They found espionage actors like India's
Speaker 1: DONT Team AKAAPTC thirty five and low level e criminals
Speaker 1: like silent Killer TV. They each incorporate Foxed pdf into
Speaker 1: their own custom design attack chains with an end goal
Speaker 1: to deploy remote ex smellware like Agent Tesla, Asyncrat, dc rad, nanocoor, Rat,
Speaker 1: n j Rat, Pony, venom Rat, and x worm. In
Speaker 1: light of these threats to fox It readers earlier this year,
Speaker 1: the checkpoint researchers brought their findings to the program's.
Speaker 2: Developers, Recabota Nime, giving me to my attention that instead
Speaker 2: of versions twenty four three. But there is that they
Speaker 2: are going to fix it. They did that fix even earlier.
Speaker 2: So the fix that they provided, in my opinion, is
Speaker 2: not the perfect one, but it is a fix that
Speaker 2: will solve the problem of the users just clicking okay
Speaker 2: or the clicking enter without checking what is being asked.
Speaker 2: So what they actually did was to switch the default
Speaker 2: option from open that it was before two don't open.
Speaker 1: So basically everything is the same now as ever, but
Speaker 1: instead of open being highlighted in blue, do not open
Speaker 1: is highlighted instead. It's not nothing. Foxy users will now
Speaker 1: likely end up not choosing open quite as often for
Speaker 1: documents they shouldn't open, but that might not save most
Speaker 1: of them.
Speaker 2: Thirty of the pdfiles that I observed, once you were
Speaker 2: clicking them and opening them, it was a black page.
Speaker 2: That still for users that are just users of the computers,
Speaker 2: if they see that okay, I click don't open and
Speaker 2: I see a wide page, maybe they think if I
Speaker 2: click open, they will see the actual content of the
Speaker 2: PDF file. My opinion, Foxitree that needs to do in
Speaker 2: the future a more robust fix which will not let
Speaker 2: thread tactles take advantage of the software against the users.
Speaker 1: One more robust type of fix might be too band
Speaker 1: for example, executing files from remote servers, a classic indicator
Speaker 1: of hacker behavior. More advanced solutions might involve detecting and
Speaker 1: blocking the kinds of commands hacker use in the course
Speaker 1: of their attack chains.
Speaker 2: In order for this vulnerability to trigger, they need to
Speaker 2: use some specific pdf A keywords that trigger the command line.
Speaker 2: So this type I would possibly not allow these keys
Speaker 2: to execute anything.
Speaker 1: In the grand scheme of cybersecurity. The design issue in
Speaker 1: Foxed pdf reader is really very minor, but it speaks
Speaker 1: to a much larger and more impactful phenomenon will probably
Speaker 1: have to deal with for as long as there are
Speaker 1: computers around. The instinct to default two Okay, I'm not
Speaker 1: even talking about the ignorance that goes into clicking it
Speaker 1: or the laziness. I'm talking about the way our brain
Speaker 1: works that we default to believing in what we see.
Speaker 1: Social engineering experts have preyed on this aspect of our
Speaker 1: human nature to trick employees of companies into opening emails,
Speaker 1: giving them sensitive information on the phone, or sending a
Speaker 1: large amount of money to an unknown bank account, and
Speaker 1: for years, users of Microsoft products enabled macros simply to
Speaker 1: get rid of the notification because it didn't even register
Speaker 1: as something to worry about. I'm careful to call this
Speaker 1: an instinct and aspect of our nature rather than an
Speaker 1: issue or flaw in human psychology, because ultimately it's a
Speaker 1: good thing. Imagine if we all walked around every day
Speaker 1: scrutinizing every little thing that comes our way, worried that
Speaker 1: everything anyone might say could be a lie. Society would
Speaker 1: break down. We would all be unhappy. In the best
Speaker 1: case scenario, we would all just be extremely tired every day,
Speaker 1: having to expand so much mental energy. In his book
Speaker 1: Talking to Strangers, Malcolm Gladwell points out how people who
Speaker 1: are extremely careful and untrusting of others can sometimes times
Speaker 1: achieve amazing things in the world, but often at the
Speaker 1: cost of their own well being, and they have to
Speaker 1: be the exception, not the norm. So he writes, quote,
Speaker 1: we could start by no longer penalizing one another for
Speaker 1: defaulting to truth. To assume the best about another is
Speaker 1: the trait that has created modern society. Those occasions where
Speaker 1: our trusting nature gets violated are tragic, but the alternative
Speaker 1: to abandon trust as a defense against predation and deception
Speaker 1: is worse in cybersecurity. We often tell people don't trust emails,
Speaker 1: even if it seems legitimate. Always check the sender before
Speaker 1: you do X, make sure you check Y and Z first.
Speaker 1: And yet cyber attacks keep rising every year because this
Speaker 1: just isn't sustainable. The average person gets around one hundred
Speaker 1: and twenty emails a day, and a lot of you
Speaker 1: listening right now, we'll find that number laughingly low. You
Speaker 1: just don't have the energy to double check every communication
Speaker 1: you receive, every button you click in every software program
Speaker 1: you use throughout the day. That's why to close our
Speaker 1: today's story, we're going to leave you with a bit
Speaker 1: of advice that might be a little easier to implement.
Speaker 1: Just you know, keep an eye out for stuff.
Speaker 2: This can't happen, even though Facebook does not allow malicious
Speaker 2: spiles to be said through charts, but actually it can happen,
Speaker 2: So be careful. Just read whatever, and whenever you're not
Speaker 2: sure about something, does better and don't open it.
Speaker 1: Don't worry over every email you get, or every message
Speaker 1: online or every file attached to them. Just be aware
Speaker 1: in general that they could be something other than what
Speaker 1: they seem. Keep the thought in the back of your mind.
Speaker 1: You'll open a document click okay once, but then the
Speaker 1: second time you've got the option, maybe a little voice
Speaker 1: in your head will tell you take a second and
Speaker 1: look at this. It might well help you avoid a
Speaker 1: potential headache. That's it for this episode. Thank you for listening.
Speaker 1: For past episodes of the podcast, visit Checkpoint Research blog
Speaker 1: at research dot checkpoint dot com, and you can follow
Speaker 1: Checkpoint Research on Twitter or follow me at at rand
Speaker 1: Levy do't r a n l e v I. Sipy
Speaker 1: Radio is produced by p I Media, written by Innate Nelson,
Speaker 1: produced by Hila Sheemish, and edited and narrated by me
Speaker 1: rand Levy. See you next episode, Bye bye.
Speaker 2: What did you want to Do