ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
CyberScooppublished ()ingested @HowellONeill

China's national vulnerability database is merely a tool for its intelligence agencies

criticalVulnerability exploited in the wildimportance 60CVE-2017-0199
Read the original
Tagscve-2017-0199vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2017-0199
Remote Code Execution in Microsoft Office and WordPad via crafted document files

CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation.

Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update.

7.8100% KEV ransomware PoC ×6
  • Microsoft Office
  • Microsoft WordPad
masshundreds of millions of Office installations worldwide (exact count unknown)
Full article752 words · extracted from cyberscoop.com · click to collapse
Skip to main content

Get our latest cybersecurity news first on Google.

Click here!

"This data manipulation reinforces the dominance of the secrecy mandate over transparency in China," said a researcher.

china national vulnerability database
(flickr)

China’s National Vulnerability Database is being manipulated so vulnerabilities used by Chinese-linked hacking groups can be taken advantage of, according to new research from Boston-based cybersecurity firm Recorded Future.

The database (CNNVD) is on average two times faster in posting vulnerabilities, and it is significantly more comprehensive than its U.S. counterpart, but researchers showed in November that China’s intelligence community effectively runs the database. The Ministry of State Security (MSS), where the CNNVD is housed, evaluates vulnerabilities before they are published to see if they can be used in intelligence operations.

Now, Chinese officials are doctoring initial vulnerability publication dates in what appears to be a sloppy cover-up, researchers say.

“CNNVD had gone back and backdated the publication days for 99 percent of the vulnerabilities we identified,” said Priscilla Moriuchi, the director of strategic threat development at Recorded Future. “What they had done is eliminate the publication lag which is one of the things we used to determine which of the vulnerabilities the MSS is interested in.”

The research shows that countries known for advanced hacking operations continually go to great lengths to obfuscate their tools, techniques and procedures.

Below is an image illustrating the issue: On the left, a screenshot from October 23, 2017 shows vulnerabilities found in software from the Chinese firm Adups. This software has repeatedly been found to secretly siphon off large quantities of user data. The publication date is September 6, 2017. On the right, the same page with the publication date changed to January 13, 2017, a backdating of 236 days.

(Recorded Future)

Moriuchi and co-researcher Bill Ladd said that by retroactively changing the original publication dates on these statistical outliers, “CNNVD tried to obfuscate which vulnerabilities the MSS may be utilizing and limit the methods researchers can use to anticipate Chinese APT behavior.”

“It is not surprising that the Chinese government is holding on to a small number of high-value vulnerabilities that it is using to penetrate targets to further national security goals,” Paul Triolo, practice head for geo-technology at the Eurasia Group, told CyberScoop in November.

The delays in CNNVD publishing have an impact in the greater digital ecosystem. Last year, publication of the Microsoft Office vulnerability CVE-2017-0199 came out 57 days late on the Chinese database. In the meantime, a Chinese advanced persistent threat group exploited the vulnerability in cyber operations against Russian and Central Asian financial firms.

CNNVD is primarily used by East Asian companies. MSS’s primary mandate is domestic surveillance. Its secondary mandate is foreign intelligence. Controlling CNNVD allows them to control the information environment in China, Moriuchi explained.

“This data manipulation reinforces the dominance of the secrecy mandate over transparency in China,” Moriuchi and Lund wrote. “Instead of taking steps to remove the undue influence of secrecy and the intelligence services over vulnerability reporting, CNNVD has gone the opposite way and sought instead to further conceal that influence.”

CNNVD officials did not respond to a request for comment.

Editor’s note: Join us on April 16 for SF CyberTalks to hear Priscilla Moriuchi and a number of other cybersecurity experts discuss priorities, trends, innovations, and ways to tackle unprecedented security challenges.

Latest Podcasts

Text extracted automatically; images, tables and formatting may be missing. Original: https://cyberscoop.com/china-national-vulnerability-database-mss-recorded-future/