[Music]
okay so my presentation is about micro
problems and micro solutions I mean
solutions sometimes small solutions are
efficient for big problems first I'm
going to give you some context regarding
macros how we got here also I'm going to
talk about some attacks curiosities and
statistics regarding how micros work and
finally some small solutions but in the
end are efficient Ellison toast
[Music]
starting with my presentation I would
like to explain what an office macro is
I'm sure that you've heard about my
first before but to sum up micros
involve introducing extract executable
code in an office document execution
driver with a BB a micro slang with and
this is used in with legitimate purpose
but also with tracking purposes there
are more malicious markers than
legitimate macros and they are used to
automatic cell and world processes to
access databases and they are very
powerful you can do anything with them
so also our trackers can do anything
with the macros that are integrated in
our embedded in the documents micros for
what an excel which are the most popular
ones are executable code that is used
when you launch a document so this is
why it is so dangerous to launch
documents
via email for example so dangerous that
many years ago they published that 45%
of attacks were done by office markers
and 37% through CBE 2017 one one eight
eighty this is a problem when processing
equations in word the model in the
engine that processes equations exceeds
the power the power of the buffer and
when you double-click it it starts
executing code so about almost 80% of
problems which malware can be introduced
in systems is office these are other
graphs explain how much things have
changed in in 2016 the highest number of
attacks came from Navigators up to 45
percent while in 2018 about 70 percent
of attacks we're coming through with
office documents micros or vulnerability
cells such as the equation vulnerability
in 2016 this amount how did about 16
percent and this has increased why in
2013 Java for example accounted for
almost the whole high but now it's not
that important also browsers in 2016
we're also the most popular attack adult
large for example PDF
we're causing more problems treetog ryu
all these things arrived threw off its
macros so one of the biggest problems
that we have right now are caused by
just opening and office documents and
local governments have been attacked for
example through these resources and well
we why Mike Rosario they are easy to
hide their lady teammate and the user
enables these macros even though they
are disabled by default and so we are
going to see the tricks that they use in
order for the user to to enable these
macros they are more complex even though
some Sun boxes can be used but it is
more complex to emulate these are
usually sent by eye and the server level
this is analyzed statically and this
type of analysis can avoid antivirus
very easily also opening an excel or a
document may be as dangerous are us
clicking on an executable program and
the attackers can only use this method
in order to attack not a growth browsers
at all Java are not a way of introducing
these type of viruses so an email is the
best option for them we don't know what
they will use tomorrow but this is what
they are doing right now
I'm going to explain where the macros
are if you open dot X document and
typical 2013 documents you will see that
this there is a seed with a lot of XML
documents and if you have macros here
you will see in point
I mean pin and this is where
everything that I'm a current needs to
execute if we click on that pin which is
C and can be open with the program you
will see that inside there is a project
and a folder VBA which is the code in
which macros are writing have written
and if weekly inside there will be a
through all a browser we will see that
there flows macros etc I mean this a
project success dotnet you have to
compile it execute it we will see this
later so well as I was saying it has our
configuration file project with empty
office has the engine engine is going to
interpret and execute the commands the
layout of the project because it's a
programming project then the streams of
the Molly modules depending on the
number of macros and then there is
something called performance cachet we
will see later in comprehends compressed
source code this is very important I
don't know if you've seen a macro I will
I will show you a video later but if you
open a macro with office you will I mean
if you open office you will there is a
top that writes macros and you can see
the source code of the macros not just a
compiling a item but also the source
code and why because probably as
Microsoft wants to compatibility with
previous versions if you launch a macro
compile for an engineer you open it
without the different version engine
this is going to compile the code for
you so that and that helps the
inspection spray and as there are
different VBA engines if you open macro
2016 in a 2013 13 office you are going
to be able to read because of the
compilation
it is why the source code is already
it's also embedded there are many
different types of type of documents and
also because of everlasting
compatibility we're going to see that
there are different type of documents
that coexist for example open XML is the
current type of document which is later
than 2006 c7 and the extensions end up
in X these are zipped documents that
have an object an XML configuration
before the classical dog was something
was not easy to understand that was an
object in itself with a binary when the
document had inside the macro with
another document in the embedded allow
you to navigate through the document but
if it was not so easy because it was not
something in standard there are more
formats even though they are not as
famous and that have emerged again
because attackers are using them in
order to hide their intentions so these
are weird format use the name is similar
to office XML but it is not open XML the
previous one that we've seen Microsoft
invented a format called open XML which
is not the same as the one that we've
seen before Microsoft Office XML example
in we keep a Wikipedia you can take
these format XML this is just plain test
you can paste it here
in a document you can keep it and if you
change the name to dot docx opens as if
it was a document if you want to change
the format you can do it here and it
will keep on being a document but now I
think I'm trying to open it so I
converted it to a new document it it
moved from the docx format to this is
unknown format and in order to introduce
macros you need to add base64 because it
is binary and it is that beam point is
encrypted in base64 I saved it in the
older format and as you can see it is
binary so you can understand anything
there are other many formats where you
can add macros in an attempt to alert
the user when document had a macro
several years ago office renamed it as
doc M which means document with macros
with a small alert the problem is that
it also needs to recognize doc so you
remove the M or you add an X and then
you don't get that alert so it's useless
there are other kinds of macros which
can be included in templates and each of
them has its own format like modern
template older template there are many
many macros
: malware us before macros malware
between 1997 and 2003 it was quite
popular Melissa for the older ones was
malware that affected 20% of people it
would send you a document you would open
it and the macro would take a look at
your contacts and it was recent to
itself at that moment there was no
security macros were executed by default
only by opening the document which is
something crazy today so there was no
awareness on security 20 years ago and
it was they were using Windows XP and
backwards from 2003 to 2013 no one was
using the macro malware in order to
perform attacks but at a certain point
maybe in 2003 functionality was
implemented macros were not executed by
default you would get a warning you know
that you know whether you wanted to do
to execute it or not it was easier to do
it in another way this way was forgotten
however in 2014 this malware came into
force again the fact that computers were
awful in terms of security Java was
awful and the others are well as well so
attackers found in macros and in social
engineering being used the most
vulnerable one a formula that has been
successful seems to
1:14 here I'm going to show you the
graph think PowerShell starts to be
vicars they detect that from macros they
can call PowerShell it is important for
PowerShell to be obvious because it can
execute many things without affecting
the disk and if you do not affect the
disk you're not going to be the tactic
by detected by antivirus so the
combination of macro and PowerShell
became very powerful since 2014
these Microsoft graphs show the moment
when somebody detected the power of
macros and they tell telemetrics sword
there we have the link we're going to
see some curious formulas or that show
the evolution of attackers in order to
hide macros first it's also engineering
as it is activated by default the
attacker is hope is hoping that the user
activated in order to do so they use
different techniques they send
instructions to activate macros for that
document all the times they say this
document is protected so you have to
enable macros in order to get affected
others say that day of his version is
not supported another one is that the
file is encrypted and clicking on the
link you will you will decode it so
everything is done in order to enable
macros also enable macros because your
code your encryption is not good and you
cannot see the important in May
you know the document here the document
is blurry so if you click on the button
you will see it perfectly clear there
are several techniques these are the
most elegant ones which are infecting
several victims simply they say I need
admin admin privileges which should
already tell you that this is species in
order to enable the macros in the end
here it says in order to activate office
you need to enable macros there is
Twitter by these famous Twitter account
that say yes
they infect me another curious point
about this macro I think there was an
Asian country where attackers the macros
you can see it says enable content so to
extract the macros from its typical
location this document had some white
pages and then something weird if you
zoomed it because the font is tiny leads
you to code in base64 which is a binary
which in the end will infect him but it
was written in the document not in the
macro itself at least in today's they
used another format called M HTML which
is like
eight tml and if you rename it as a dog
it also works as one in this video I
take the doc human and I left over there
before I drag it here binary format I
open it in Word and I'm going to save it
as an HTML which is format I wasn't
familiar with it's useful to create
websites through worried as you can see
the icon
I will just say so it transforms into
under my eyes I can add macros to that
dock for Tonto
therefore these people had created a
macros which was taking the content of
the document it executed you see that
deal no four month at least HTML so and
it opens it with Microsoft Explorer
instead of Microsoft age due to backward
compatibility I brought a video on I
don't know if you will be able to see
well it's a bit smoother it's DML you
have a program that portal is the macro
and was writing on the registry even if
it was HTML in the end it was a document
with the code in order to decode these
was discovered you know that years
malware
teas velvet is the magical word in
office I don't know if you're familiar
with it I don't know if you know it was
introduced by manufacturers of office so
that if you created a document and
protected it with that password it was
like having no password it is embedded
and it is like a joke password I don't
know if you have ever protected with
password an Excel you can do it here in
your settings you click on options and
you say I want the Reading Mode to be
protected so I copy and paste the
password velvet switch shop for the
Reading Mode and I save the neck so when
I open in the Excel document again
without any problems
if I save again with any other password
maybe I can add a letter to this velvet
shred shop okay so I'm opening the Excel
again first you need to blow so now
they're going to ask me Danny password
so attackers have green have been using
that password in order to hide usually
use passwords but they are included in
the email of the on the email so they
send you a document and
with the password on the email and
that's the way they get to not to be
detected by antivirals because the
antivirus cannot open the document
without that password this is another
thing about Excel 4.0 which were XL m
macros very old macros which are still
compatible although I think they are
only used by attackers it is easier to
perform than it basically you need to
type here whatever you want
oh sorry JAMA and these calls the wait
it's wonderful because you generally
affect the date you create an object in
memory you have the executable years and
you type this part of the memory and you
create the thread so it is already
launched so when you open an executable
when you're opening and Excel you are
going this was quite simple so I was
quite shocked shocked and I decided to
try it with this format for the macro in
this video I think you can see I was
calling power shell which was calling
URL and when I open simple Excel
executed the power shell these was not
detected by many antivirus it was
executing code
cuando you see the cold these these were
techniques and now I'm going to talk
about some curious attacks that caught
my attention I had Micro Four for Open
Office recently it was discovered that
when you were disabling the mark
it wasn't being disabled they cannot get
rid of macros there is another curious
technique that I discovered in my study
which is to add many comments on the
code such as this one make no sense
others do make sense they are complete
words which are there to get a victim's
distracted they some of those codes had
plenty of Microsoft URLs for example in
order to get people distracted all the
techniques is to use the the power
creator in PowerShell through which you
can create whatever you want and if you
added to Metasploit in order to do an
adequate payload it works quite fine if
you just have to launch the exploit you
invoke the macro and then you can do
things like this without knowing of them
you can do things like this for the
kernel functions such as stealing
passwords and so on
everything is created in a simple way
with many functionalities which one do
evil for example occasions and all the
formulas you have to launch code are
considered in this attack because they
distract antivirus and you can have
macros where you add a huge piece of
code which in the end is an executable
but they need to be skated somehow and
this was done through my framework
another crazy thing that we discovered
is that ribbons those deployable menus
on a panel which have a square form they
have hidden in those ribbons because you
can create ribbons with macros and they
have managed ribbon database enables you
to update ribbon database thus creating
a macro when you open it it the cool bug
in the layout of the HTML of the macro
and in the end if injected was not like
a macro but like an update of the ribbon
another thing is that they haven't tried
to hide the code everywhere VBA has
visual elements you can open a window
with a point net you can create buttons
you can create events one of the things
they have done is to hide in the
properties of
the graphic elements not within the code
itself they want to avoid in any way
video I have because I was always I
couldn't find it so it was hidden but it
was obvious kated Mufasa you know and
then this is another example in the
video but I feel there is a similar
example because I realized it was more
common than it was thought
go to the macros menu outer open which
opens directly then I search I've turned
here it is Jewish al an alternative
replace replace of rocket for an A and I
inserted for you know the to pass by all
the alternatives and then I could see
PowerShell but it was obfuscated because
it is full of brackets and so on it is
quite crazy but it is what attackers are
using to in fact nowadays the examples
caught my attention it was the only time
I could see this kind of attack there
was a macro hidden it was not a fiscal
heed it was under camouflage as you
understand you can as you can see you
can barely understand what this code is
did quite the opposite first of all some
part of the property of graphic elements
there was a code for an executable and
then the code that process that
executable was quite readable and it
seemed real you have currency connected
users constant problem it seemed
completely real but when you debug it it
was sending commands such as this one
calling a shell in order to be executed
so it was being hidden behind apparent
real code from feet to centimeters but
in the end behind that code the was a
call for the execution in order to make
the calls seem legitimate problems
problems do it they were using the term
dual on many occasions and this
executable was going to be saved in the
disk and was going to be there was even
code written in Spanish and in the end
that executable Wars executed I tried to
find who the author of this has been
this was my only my only clue to cover
it and it is a Russian singer obviously
I don't think this Russian singer was
the author but it was included in the
code I have several examples here I
think I loaded it before okay it is not
showing it can't I show it on the screen
what I want okay I we had some macros in
which the code can be in which the code
tries to detect if it is in math then
it's it launches Python but if it is in
windows it launches pollution it is not
common but it was also their objective
their target so here it is what we did
was to oh I can't see right now what we
did was to create and macros oh sorry
give me a second I lost the use I'm
sorry we did some macros in order to see
how easy it was for it not to be
detected this macros is quite catches
your attention
Ede extracts all the information sent
the money but this was not detected by
antivirus is not a problem of anti
viruses it is quite complex to be
detected so we went far beyond and in
one macro so I could send this through
word and it said you are very wrong and
this macro all these type database of
conversation and the attacker could
download that information and see all
your conversations
and the only thing that the victim did
was to receive a document and open it
that office document was created in just
a few seconds and it was unnoticed by
antiviruses because it seemed normal
wasn't difficult at all one of the last
ones is this macro it is not common but
they have done it on several occasions
this macro instead of downloading
something malicious was to download a
compiler in order to compile a program
dot net in the system and this one was
encrypted and the key to encrypt it was
in a txt for a document in located in
DNS it was the craziest things that I
have seen and it was using words bug
series so very common words in variables
so that it had normal appearance one of
the techniques which is quite used is
the do as obfuscation it is quite
fashionable right now it is something
you could do in Windows you start
injecting these little thing of the of
the letter N and you are executing a
PowerShell without writing coercion you
take the PWD and then you're typing
PowerShell without typing it because
obviously that's going to be detected by
antivirus so they write different words
and which are cut into small pieces
another interesting one also I have
mentioned it earlier is that the
compiled code is stored as the source
code is installed as well this is quite
good to analyze statically the macro by
anti viruses so they do this in case you
open this document in an office with non
updated engine then they compile the
source code and I execute macro but what
happens if we just if we start typing
anything in the source code like a lot
of serials or once nothing happens if
the version matches if the compiled code
works in your office nothing will happen
so attackers mmm invented W VP a
stamping where they delete the source
code embedded in the macro and they just
used the Qin file code this is quite
interesting and quite successful Here I
am going to launch a document in these
two we're going to see the macro of
these documents you see there are five
macros k with different keys if this
same job human which is the macro source
code has been deleted there will be
another macro which is quite difficult
to understand I stomped it with that if
we look at the code in depth we will
realize that will I have down is that
where there were some key here you can
read the
source code and here it is destroyed
with added so VBA stomping has become
quite popular so much that my new tool
every clipping has been developed I
don't know if you remember creepy it
looks like he is writing a letter and it
says it looks like your man dog doesn't
get bypassed AV do you want me to help
you and this facilitates the V be a
stomping action it destroys the source
code and it uses the compiled code the
template the makes a call so you can see
the server so there is a whole story
about it so that you can not you don't
have to access the source code and the
attacker in the end can execute like
most of the markers are unique markers
if you were wondering if they are reused
and there are statistics regarding
unicity most of them are unique only 20%
25% are reduced why because there are
many obfuscation so it is weird to find
malicious macros which look the same
also other common mark characteristics
regarding malware is there the merging
of 64 based change for example
hexadecimal change and also this this is
something interesting regarding the time
between creation of the document and
last modification which is less than one
second as this is completely automatize
these studies confirm
what we already knew also regarding
number of micro they're easily to but
this is also related to two trends when
this study was done only one micro was
the most frequent valley and now
regarding solutions how is it possible
that we are facing the same problem that
we've been facing the same problem for
20 years and what can we do do to avoid
it so here have five different
mitigations or solutions I'm not going
to explain this one because it is quite
complex but there are different formulas
and you know that to enable the
PowerShell logs PowerShell and macros
are very linked so having a good
visibility of what's going on in the
system PowerShell what's being executed
allows you to to to learn about this
regarding the extensions extension
associations we have to pay attention
sorry we don't have to trust the
extension the part of being dok dok s
there is a tool called
make em easy that tells you if a
document is HD ma that thinks is a dog
that is faking
or pretending to be a dog or if it is
our dog am pretending to be a dog this
can be analysed through this tool a two
that are CH step program in regarding or
using the magic number not the extension
for example it's safer to open air RTF
with word Python we with work because
probably an RTF wants to exploit the
vulnerabilities that we've mentioned
before
also we have to assess to check the use
of IES are and trust in MCAS I if you
are an ADIZ in micro speakers you won't
probably use them you should enable
disable them and how can we do that I
mean if you have a network for example
they seem the most simple thing to do is
downloading these templates from this
address
hoping a DM X here and then you have the
option that says blocking the execution
of macros you click here you need all
these and then the your system is not
going to execute macros for example at
the level of active directories it is
quite useful how can we make our system
not to open certain type of document
such as 4.0 macros or similar extensions
here in this configuration of Excel and
Word file block in configuration you can
see that you can lock all these prevent
that these documents with these
extensions are opened or it saved it is
highly unlikely that someone tries to
send you a dog that it is an XML or
something like that all these documents
that I've mentioned are formats that are
not frequently sent so you can block
them here and this is the same
configuration Word document also 4.0
documents I can be blocked here Windows
10 to the rescue we understand is
working on a SR these are like recipes
for specific problems only Windows 10
has these features and it is under
development some recipes work better
than others but there is several of them
you're not going to be able to learn
this by heart but you can try to get an
over V so for macros they offer Windows
10 offers to block all of its
applications so that they don't create
secondary processes you know that to
block this type of malware I mean all my
words create child processes but in
order to avoid that you can do at least
in PowerShell I mean this name is quite
ugly right now but it is a rule attack
reduction you click enable and office
won't be able to open a child process
simple after a start but it is not very
well known it is not this is not similar
to this one this is something different
which is not allowing second hypothesis
is this is going to block function such
as shell CMD or calculator however this
is not going to be able to rule with a
different number which is called
blocking API calls of win32 from off its
macros we've seen the current authority
thing that we cannot do that if we apply
that you are going to be deleted many
macros and these calls are not going to
take place anymore if you do that if you
enable these you are going to see that
screen and you won't be able to open the
file and the last one this is a rule
which was recent recent
if you you start you won't be able to
call WMI rules so with these three rules
you are going to delete all the basic
functionalities of macros and they won't
be able to execute to be executed this
every sources won't be won't be
available anymore this program is
something that a little problem that
someone did and that sometimes doesn't
work but it is quite useful I'm
launching the ASL a is our rules from
here I can create an executive an
executable program I'm going to learn
that rule and with naval and here I will
see that this is block I'm going to
create another rule in order to see if I
can have executable programs from office
defender stop this okay so great this is
working quite well you can test it if
you want to also memory is being widely
using attackers create memory with
PowerShell and with binary so wouldn't
it be wonderful to cut the malware in a
memory antivirus cannot do that but it
happens that Microsoft has created
someone called MC which helps you scan
the memory of PowerShell shell and it
scan it through Windows Defender this is
wonderful because it changes the whole
antivirus paradigm that we already know
and it is quite innovative only Windows
10 offers that option it is called MC
AMS I know it can only work for power
powershell well recently it was also
launched for office 365 everything done
in the memory of office 365
we'll also go through the memory both
room Windows Defender sorry before
touching the DS before reaching the disk
and if you have this a.m. as I enabled
you can also call me Mimi cuts with
PowerShell before me cut it reaches the
disk it's going to be cut only by doing
the call here you can see that this
happened before reaching the disk if you
have the a mas I enabled and they are
trying to extend it to other areas not
just PowerShell so conclusions
micros never left us we are back
stronger than ever I don't know if they
will stay because now office365 is going
to be virtualized office is going to try
to work on completely virtual process if
they are able to do that with office
then this problem won't exist anymore
our compatibility is always a threat and
we have more formulas to defend
ourselves than the one that we think
even though we don't know them so well
thank you very much
are there any questions well if you have
any questions I would like to invite you
to ask to talk to the speaker outside we
are running a little bit short on time
and we have to stick to the agenda today
but thank you so much for your
presentation
[Music]
[Applause]