Let's talk about macro-problems and micro-solutions.
In the sense that the solutions are not many, but they will be quite effective for what we consider a serious problem.
We will talk a little about the antecedents of macros, how we have come this far, some curious attacks, and some statistics on how macros work, because we have studied them a little in depth.
And, as I said, some small solutions, but we think they are effective.
After all, this is what you can get out of the talk.
I am Sergio de los Santos, as I have already introduced myself.
First of all, just in case, I will explain what an Office macro is.
I assume you have heard a little about what macros are.
In short, it means putting executable code in an Office document.
As you know, execution is the origin of all evil, so what could go wrong?
If you don't know, Office has an execution engine, a language, which is VBA, the macros.
And it is used for legitimate purposes in principle, but almost more for attackers.
There are many more malicious macros than legitimate macros.
They are used to automate processes in Excel or Word, to do it on the basis of data, and it is very powerful.
You can do whatever you want.
Therefore, attackers can also do whatever they want with the macros that are embedded in the documents.
For the most part, there is the macro concept for Word and Excel.
And as I said, they are executable code when you launch a document.
And that's why it's so dangerous today to launch documents, even if you think you can't, by mail.
Those who can reach you by mail or find you there.
It's so dangerous that I don't know what year this is exactly, but quite recently, 45% of the attacks occur through Office and Macros.
And the other one, which I don't know the color, but it's 37%, is attacked through CV 2017-18-82.
That's a problem when processing the equations in Word.
The engine that processes the equations and puts the summation and so on, has a buffer overflow.
And when you can prepare a specially manipulated document, when you double-click it, it executes code for you.
That is, between the two, almost 80% of the malware that enters the systems comes through Office.
Whether it's Macros or a vulnerability that is still used a lot.
It's called the Equation.
This is another example of how the theme of Kaspersky has changed in one of his talks.
That's why the photo is bad.
In 2016, most of the attacks came from browsers, up to 45%.
While in 2018, 70% or so, according to Kaspersky, of the attacks also came through Office documents.
And usually Macros or vulnerabilities like the Equation.
You see that in 2016 it had a little significant representation, approximately 16%, and that has increased.
Why?
Because browsers have improved their security a lot.
Also because Java...
Well, Java was already in decline in 2016, but in 2013 it occupied all the cake.
What happens is that it has already gone down a little bit and, well, the attackers go where the PDFs can.
They are also a bit in decline.
In fact, 0% this year, when in 2010, 2008, 2009, it was the most popular attack.
Sending a PDF, opening it with Adobe, and managing to execute code in the system.
Therefore, this is a real and current problem.
I don't know if you have been to other talks.
They talked about Emotet, Trickbox, Ryuk.
All this comes through an Office macro.
One of the biggest problems that there is currently for those who have kidnapped municipalities, companies, and so on.
It comes from opening an Office document.
Why the Macros?
As we are going to see in some examples, they are easy to hide.
In fact, we are going to see basically many examples of how to hide them.
The macros are legitimate.
And the user is the one who, even if it is disabled by default, usually presses the button and executes code.
We are also going to see what tricks they use for the user to press the button.
It is more complex for it to be executable.
Although today there are sandboxes, virtual environments in which you can launch and study, it is not as easy as it is executable.
They are sent by spam.
When it arrives by mail, it is more difficult for it to be launched.
The only thing they usually do when it arrives by mail is, at the server level, to analyze it in static.
And in static it is ultra-easy to avoid antiviruses.
Then, it is not yet aware that opening an Excel or a document can be as dangerous as giving it an executable.
And the attackers, as I said, have no choice.
In a world in which Java has come down, PDF has come down, browsers have come down as input methods, a document in an email is currently what gives them life and allows you to enter the systems.
What will it be tomorrow?
We do not know exactly, but for today it is the gap they have left.
I will explain where the macros are.
If you open a document, docx, the typical ones that are usually used since 2013, you will see that it is a zip that has a lot of documents inside xml.
And if it has macros, you will have a .bin here.
A .bin is where everything a macro needs to run.
If we get inside the .bin, which in turn is a zip, you can open it with the 7zip, for example, you will see that inside it has a project and a VBA folder, which is the code with which the macros are written.
And if we get inside the VBA, which you already have to do with a tool called OLE Browser, which is an OLE object, you will see that it has flows, macros, documents.
All this is a project in .NET that you have to compile, run, it has its source code and so on.
Now we will see it.
As I said, it has a configuration file, the project with the instructions for the engine.
The engine has it in Office and it is the one that will launch the macro, interpret it and execute the commands.
DIR is the one that has the layout of a project, because as I said, this is a programming project.
Then the streams of the modules, depending on the number of macros you have.
And then a thing called performancache, which we will see later, and with pre-source code.
This is very important for you to understand because it is what allows, I don't know if you have ever seen a macro, if you open it with Office, there is a little tab on the top right that says macro, you can see the source code of the macros.
Because it includes the source code of the macros.
Not only the compiled, but it includes the source code of the macros.
Why?
Because it may be that the engine, as Microsoft has the serious problem of always wanting retrocompatibility, if you launch a macro compiled for an engine and you open it in an older or more recent engine that does not work well, what it does is compile the code for you,
so that you get infected well.
This is not known much, but as there are different VBA engines, if you happen to open a 2017 macro in an Office 2003, you can do it.
But because it recompiles the flight.
And that means that it also includes the source code.
There are many types of documents.
Also, in their desire for retrocompatibility forever, so that they do not have problems, we will see different types of documents that coexist.
For example, the OpenXML format, which is the current one, in which, as I have shown, usually after 2007, are the ones that end in X.
Before they did not have the X, if you remember.
These are zip files that have an object inside, as you have shown, a lot of XML.
It is quite standard.
They did it because before the classic doc was something incomprehensible, a Microsoft format that could not be deciphered or anything.
It was an object in itself, a binary object.
When a doc document had macros inside, the macro was another document embedded inside.
And you could navigate through the document.
It was more difficult because, as I said, it was not standard.
There are more formats, although they are not so famous, that have now resurfaced because attackers are using them in their desire to go unnoticed.
This is a strange format because it is not called OpenXML, but we must not confuse it with the previous one.
In that process, Microsoft also invented a format that is no longer used, but still supported, always a fan of retrocompatibility, which is called OpenXML.
And the truth is that it is quite strange.
It caught my attention and I went to the...
Here, let's see if I can put the video.
In Wikipedia you can take this, WordXML format, which here explains it.
It is completely clear text.
You can paste it here in a document.
You can save it.
And if you change the name to .doc, it opens the Office as if it were a document.
If you want to change the format, you can do it there and it will still be a document.
But now it will have changed.
Now I'm trying to open it again.
Now I have converted it to the new document.
It has changed from clear text to .zip.
You can obviously record it with another format.
I did not know this one, it is quite unknown.
To embed the macros in it, you just have to add a very large base64.
Codify a base64 because it is binary.
But it follows more or less the same philosophy.
That .bin is coded in base64.
Now I have recorded it in .doc, the old format.
And you will see that it is a binary object that is not understood at all.
There are still many other formats that can all include macros.
In an attempt to alert the user, a few years ago, when a document had macros, you will see that Office automatically renames it to .docm, which means document with macro.
You even get a small alert.
The problem is that, as the .doc also has to recognize, everything you have to do to remove the m is literally remove the m.
You remove the m, it is already a normal .doc, you put an x if you want and it no longer alerts you.
It is useless.
There are other types of macros that can go in the templates.
And each one has its own .docx, .docm format.
Modern templates, old templates and templates with macros.
There are many formats, which makes it a bit confusing.
A little history with the macro malware.
Between 1997 and 2003, it was quite popular.
In fact, Melissa, for the oldest people here, was a malware that, in its day, affected 20% of the people.
If someone sent you a document, you opened it and the only thing the macro did was look at your contacts on the Hulu Express.
And it was sent back to itself.
At that time, there was no security.
The macros were executed by default.
You just had to open a file and the macro would launch, which is crazy.
There was low security awareness.
There still is.
Imagine more than 20 years ago.
And toy operating systems, like XP.
From 2003 to 2013, the malware fell into a lethargy and lost a lot of popularity.
In fact, it was something residual.
Nobody used the macro malware to attack.
But at some point, in 2003, the reason is because in 2003, the one who did not execute the macros by default was put.
Which was a breakthrough.
At least you got a little sign that told you if you wanted to execute them.
And attackers focused, as I said, on other easier formulas.
That you only have to navigate through a site to execute code.
So, as it was easier another formula, this one was forgotten.
Until just in 2014, the macro malware resurfaces again with a lot of force.
It resurfaces, as I said, because browsers had a golden age in which browsers were a disaster.
In security, with their plugins.
And Flash was a disaster.
And Java was a disaster.
They had a lot to throw away.
But then they saw that they did not have much more to throw away.
So, attackers find in macros and in social engineering, still in the user, as the weakest link.
A formula that has been working quite well since 2014.
What's more, here...
Well, now comes the chart.
I have two data left.
There is an additional thing and it is that PowerShell begins to become ubiquitous.
And they know that, or they detect that they can, from the macros, call PowerShell.
PowerShell is very important, that it is ubiquitous, because PowerShell can run a lot of things without touching disk.
And as long as you do not touch disk, you will not be detected by antiviruses.
Antiviruses are only hooked to the function when the disk is written, not when it is in memory.
It is very rare that they find it in memory.
So, the macro combination, PowerShell, becomes very powerful since 2014.
What's more, this Microsoft chart is the exact moment when they detected that someone discovered all this in the power of macros.
It was in November 2014 and all their telemetry was fired.
And since then, it has not stopped.
There you have the link.
Let's see some curious formulas of how, in these years, attackers have evolved to hide the macros.
The first is social engineering.
Obviously, since it no longer activates them by default, the attacker trusts that the user activates them for him.
And for this, they use all kinds of techniques.
Normally, they give him the instructions to activate the macros.
It is necessary for this document to activate the macros.
Other times he says, well, this document is protected.
In three simple steps I'm going to infect you.
Give him the button to enable the macros.
Another one says that the Office version is not supported and therefore he has to give it to Macro.
Another completely false, that the file is encrypted with PGP and that by clicking the button you will see the real content.
Another that Excel is not in the correct version and that you give him the button, all inciting him to give him the Enable Macro button.
Enable Macro also because the encoding is not good.
Give it and you will see how important this document is.
Here, the document looks blurry.
If you give him the button, you will see it clearer.
There are a lot.
These are the new ones from Moter.
Moter is more elegant in design.
And this is what is now infecting, through Trickbot, Ryuk, etc., many attackers.
He simply says, hey, I need administrator permissions, which should already scare him.
And please enable the macros.
Here we see another.
There are two variants.
Epoch 1, Epoch 2, Epoch 3 by Moter.
Here it says that to activate the Office, give Enable Macro.
Also, all kinds of Tetras.
So much so that there is a very famous tweet by Taylor Swift on Security, a parody, that says, hey, why don't you stop calling Enable Content to the button and call it directly Infect Me?
Because it's true.
This macro, another curiosity, said in, I don't remember, an Asian country.
In his eagerness, the attackers have even managed to remove the macro.
There you see that it says Enable Content.
You have to remove the macro from your usual source.
If I click here on the video, you see that this document went down.
It had some blank pages.
And then a very, very strange thing.
If you zoomed in, because it had the minimum type of letter, like when I used to use Chuleta, it takes you to a code in Base64.
That code in Base64 is a binary.
It is a binary that in the end will be the executable that will infect you.
But they had written it in the document, not in the macros.
Something quite curious.
And they also made use of another format called MHTML.
If you don't know it, it's like an HTML that you rename to doc and it also works like a doc.
This is quite curious.
Here in this video, I go back to the document that I had left out there.
Let's see if I can hit play.
I take it here.
It is in binary.
And I open it in the doc, in the Word.
And I'm going to save it as MHTML.
Which is a format that I didn't know much about.
It serves for something as useful as making web pages through Word.
As you can see, it changes the icon and renames it to MHTML.
But all I have to do to fool you is put a doc.
And it becomes a doc.
And it works exactly the same as a document.
I can add macros to it.
Therefore, these people had made a macro that took the content of the document in turn and executed a code.
There you see that the usual format to open the HTML is even the browser.
And you also do it with Internet Explorer, even if you have Edge.
Well, these are the stupid things they do in Windows for backward retrocompatibility.
Here, it seems to me that I have the video, but I don't know if it's going to look good.
Yes, it doesn't look very good.
But for the HTML format, you see that what it did is a program that opens the macro.
What it did there was write you in the register.
Here it looked very good.
Although it looked like HTML code, it was actually a document with macros inside.
And also there it had the function to decode that base 64 that we have seen in small.
Another curious macro that discovered this is something that very few people knew, but they discovered it to make malware.
And it is the use of this word.
Like the velvet sweatshop.
This word is quite magical in Office.
I don't know if anyone knows it.
It is a password that the creators of Office made fun of so that if you created a document and protected it with that password, it was like not having a password.
It has it integrated and it approves it.
I do the demo here.
I have a normal Excel.
I don't know if you have ever protected an Excel with a password.
But hey, you can do it.
There in tools you give options and say I want the reading to be protected, for example.
I put the password so you can see that there is no cheating.
Velvet sweatshop.
I copy and paste it as a reading password.
And I save the Excel.
When?
I'm going to open Excel again.
Here I close it.
There I was preparing the PPTs.
I open Excel again and I open it without problems.
If I save it again with any password, in this case what I'm going to do in more options, tools, to the password it already has, which is velvet sweatshop, I add a letter.
Any.
I say OK.
OK.
I'm going to open Excel again.
I close it first.
When I open it again, the expected behavior is that now it is going to ask me for a password.
But if I put that in, no.
Well, this has been used by attackers to go unnoticed because the antivirus did not use that password to open and the attackers did.
Attackers do usually use passwords, but they put it in the mail they send you.
It says, open this Excel.
By the way, the password is I don't know what.
You open it and you get infected.
And so they have gone unnoticed by the antivirus because the antivirus cannot open the document because they do not have that password.
It's a usual trick.
But with this they made it even easier.
In case you thought this was over, they discovered something from 1992 that still had retrocompatibility, which was 4.0, which were XLM macros.
Some old protomacros that I don't know who uses them, but they are still compatible.
And well, I do know who uses them, the attackers.
It is much easier to do than it seems.
Because here I have a video in which you have to put, practically write what you want here in the macros.
This, in case you don't know, calls the function of the kernel, the virtual lock, which creates in memory the object you are going to launch.
It's wonderful because you don't even have to touch the disk.
Again, you create an object in memory.
Here is that executable.
And here you write in that memory cache that you have reserved.
And here you create the thread.
It is already launched.
When you open an Excel, you actually have a perfect executable, which is what you are launching.
And this is so simple, it was hard for me to believe it, so I tried it a little bit with PowerShell.
Here in the video...
Well, in case you don't believe it and you have an Excel at hand, here is a format that is the macro that you can use.
I don't know if it's here in the video...
Here it is.
Here in this video, what I did was call...
It doesn't look very good, does it?
But it was a PowerShell that called a URL.
Here I am seeing what is called from the system.
And indeed, when I opened this...
When I opened this simple Excel, the system executed the PowerShell, just like that.
This happened perfectly unnoticed by many antiviruses.
And it was accessing, it was executing code when it shouldn't, which is when I open an Excel and I see the calls of such a simple code.
Other types of attacks...
These are techniques, rather, and these are other types of curious attacks that have caught my attention.
If I do like this...
I don't know if...
Well, since I don't have much time, I'm going to skip this one.
Here there was a macro, there was a macro for OpenOffice.
It doesn't get rid of macro attacks either.
In fact, recently they discovered that both Mac, when you disabled the macros, it wasn't really disabling them, and that OpenOffice could also run Python from behind when you opened an OpenOffice document.
So they don't get rid of the macros.
There are other techniques and curious macros that I have seen studying this, in which what they do, and it works very well for them, is to put a lot of comments in the code.
A lot of comments of this type.
With or without meaning.
These are without meaning.
I have also seen many with meaning.
Whole words that are comments in the code that serve to mislead the antivirus.
In fact, in the last Motet campaigns, they put a lot of URLs to Microsoft.
Https://www.microsoft.com and some URLs.
All this full of Microsoft URLs.
Apparently, it works to mislead them.
The world of macros has specialized so much through these techniques that there is the Macro Creator in PowerShell, which is a work framework in which, through the Macro Creator in PowerShell, you can create whatever you want.
And if you also create them together with Metasploit to make an adequate payload, it works quite well.
You just have to launch the exploit, invoke the macro, and it does things like this.
Without having any idea, you can get to do things like this again.
You call the functions of the Kernel you need, such as playing discs, stealing passwords, whatever you want.
You make a little bit of code and this is all created in a simple way.
And with a lot of functionalities to do evil, such as obfuscations, if you want to launch it through CMD, WMIC, MSTH, all the formulas you have to launch code are contemplated, because they all mislead the antivirus.
And you can get macros like these again, in which you embed a very large code that in the end becomes an executable, because, I insist, normally another one in the executable is downloaded, but it has to be obfuscated in some way.
And through Empire Framework, which is what I was talking about.
A super crazy thing that we have also seen is that the ribbons are those deployable menus that come up in a panel, which are already more square, with their little drawings and so on.
The ribbons have also been hidden there, because, apparently, it gives you the possibility that you can create ribbons on the fly, with macros.
This is what attackers have come to do.
Here, UPDATE RIBBON DATABASE allows you to update the ribbon database on the fly, creating a macro.
And here, when you open it, it makes a callback in the XML layout of the macro, and in the end it injects this code.
That's where the malicious code came from, but you had to make some tweaks so that this was not a macro in itself, but an update of the ribbon that executed a code.
The truth is that they worked hard on it.
One thing I didn't know how to call is that they haven't even tried to hide the code everywhere.
Even as VBA, it has visual elements that you can open a window, like in .NET, it has many formulas, you can create buttons, you can create events when you touch the buttons.
One thing they have done is to hide in the properties of those graphic elements, in the properties of the graphic elements, not in the code.
The attackers want to elude the code in every possible way.
In this video...
It's already running.
In this video, I have a virtual machine, this is a sample of real Emotet, I think, that says, as always, Enable Content.
You hit it, I hit the button, I'm already infected.
Here is what I was saying, I'm going to go to the macro menu where you can see the code, because, as I already told you, the source code is together.
Well, the source code, there is no God who understands it, because it is very, very, very blurred.
But I went to look for something that always has to be there, more or less blurred, but which is usually a shell, execute, etc., everything that is PowerShell, everything that is running something.
And since I didn't see it, it seems to me that now I'm looking for a shell.
Okay.
And there they tell you in that shell that in alternative text, it launches something that is in alternative text.
I went crazy here looking for alternative text of the figure.
I think it wasn't there.
So I had to work...
Well, I copied and pasted from this overflow a module that iterated through some element.
I iterated through the alternative text to be able to see where that was.
This is a formula that occurred to me, because I don't know how to see it, okay?
So I'm running it there step by step, and what it does is see the...
And there, in an alternative text, which I don't know where it is exactly, I couldn't see it in the macro panel, there was this PowerShell.
You see that there is a CMD that launches a PowerShell at the same time?
There it was hidden, which in turn is focused.
Then it will have a lot more phases.
And then there is another example here in the similar video, because I saw that it was more usual than it seemed, and it worked very well with antiviruses.
Again, I'm going to see the macros.
You can all see it from there.
AutoOpen is what opens when you launch the document, not when you do any other action.
And around there I searched again, I was very focused, and I searched directly for alternatives.
And indeed, it was here.
Here there is also a Shell, an alternative, a replace of this cork by an A.
A whole crazy world of obfuscation, so that nothing is understood, what it does to the flight.
And I inserted the Forest to go through all the alternatives.
And there it showed me PowerShell again, but obfuscated in turn.
You see that it has the caps, the brackets, which it will later replace by an A.
All very crazy.
But this is what is being used today to infect.
There is one that caught my attention, I have never seen it again.
We took it out almost at the same time with Microsoft, but I found it very funny.
There was a macro that was camouflaged, not obfuscated.
As you have seen, we have shown macros that absolutely nothing is understood of what it puts, very strange letters, or code that is processed so that in the end it is clarified in memory.
This really did the opposite.
It did...
Well, the first thing is that in a text part, again, this was not an alternative, I did not know how to find it, in a text part of a property, in a graphic part, there was a call to an executable.
It downloaded it from a site.
But then the code that processed that executable was perfectly legible.
And even more, it seemed real.
Connected users, chain, currency.
It seems that it changed between currencies.
Connected users, constant problems, which made me laugh a lot.
It was code that seemed totally real.
A shell in a database.
But then when debugging it, really what it was doing behind were commands like this.
Call a shell to run.
In other words, it was hiding in plain sight, let's say, with code that could seem legitimate.
So, in plain sight.
There, it seems to me that it also comes as a change of feet to centimeters or something like that.
But in reality it was calling an executable here.
Here you see an executable, etc.
It was doing incredibly well the code to make it seem totally legitimate.
And in the end, here it kept this executable that it had downloaded.
Problems do it.
It used the word do it a lot.
Constant problems, I don't know what.
And this executable was going to be saved on the disk and launched.
But the code, I tell you, it seemed to load images, help.
There was code even in Spanish that seemed to be a perfectly real function.
And in the end, well, that executable was launched.
I was looking for who had done this to congratulate him.
I only had this clue which was Cabaret Duet Academia, which was a pretty weird word.
And it turns out that, well, he is a Russian singer.
It does not mean that he did it, obviously.
But it referred to a Russian singer with a visit on Spotify between 0 and none.
I said before, for example, I have here several examples of...
Well, I have it here loaded.
I have it loaded.
Ah, it's not there.
Okay, now it's not showing.
I can't show the...
Well, it does not matter.
I will not show it then.
Well, I had some macros in which, in the code, it can be seen perfectly that it tries to detect if it is in a Mac.
If it is in a Mac, it launches Python.
And if it is in a Windows, it launches PowerShell.
But it also tries to infect the Mac systems.
And it is not usual, but they also have it as an objective.
I come back here.
Okay, now I have it here.
Okay.
We made a...
Now I can't see it.
We made some macros.
Ah, now I can't.
One second.
I have lost the focus.
Okay, now I can.
Ah, yes.
We made some macros to see how easy it was for it to go unnoticed.
And this macro that sings a lot because it makes a call, it has a faq, it takes out all the information, it sends the money to I don't know where.
All this went unnoticed by the antiviruses.
And it was a very singing macro.
It's not that the antiviruses are bad, it's just that it is a system that is very difficult to detect.
And we went a little further in a...
I put the video.
In a macro that what it did was very easy to steal the database of your office.
This has a little time.
I could send Bob, who was the victim, an office and the guy opened it and said, you have been hacked.
And this macro that you have seen that Bob only opened took all the database of Skype conversations and sent it to a server.
And now the attacker downloaded that database and looked and could see all your conversations.
And the only thing Bob had done was receive a document by office and click a button.
And that office document we created in a while and really went totally unnoticed by the antivirus engines.
It did not do the usual.
Stealing the database of Skype is not usual and therefore it seemed that it went unnoticed by the antivirus engines.
It was not difficult at all.
And I think it is one of the last.
This macro, which is also not the usual, but they have done it, what it did was instead of downloading something malicious, it downloaded
a compiler .
And what it did was compile a .NET program live in the system.
And since it did not want to be detected, it encrypted it.
And the key to decrypt it was in a TXT registry of a DNS server.
This is quite researched, one of the crazy things I have seen here.
In the QMLs it also downloaded information and also used words such as shush, back, I don't know what.
Very common variable words to make it look like a normal project.
One of the techniques that is also used a lot not only in macros is obfuscation 2, which is very fashionable right now.
Obfuscation 2 is something you can do in Windows.
You start to inject this figure of the n and this is what makes you take pieces of words.
And here, even if it doesn't look like it, in the end it is launching a PowerShell command without PowerShell.
With this you get the P, then you take the O, then you take a W from here and you write PowerShell without writing PowerShell, which is the cursed word that will make you look like an antivirus.
So they use this technique a lot, they write other words and they cut them out.
And one of the last ones, which is very interesting, although I have already advanced it a little, I told you before that the compiled code is stored, but also the source code.
The source code is very good for antiviruses to statically analyze the macro.
There you can see everything that it is doing without having to compile it.
I told you that they do that in case you happen to open this document in an office with an outdated engine.
Well , I compile the source code on the fly and I run the macro.
What happens if we crush the source code with anything?
With zeros or we delete them?
Well, absolutely nothing happens if the version matches.
If you don't have to pull from that source code and compile it on the fly, but the compiled code works in your office, absolutely nothing will happen.
What did the attackers do?
They invented a technique called VBA, not VPA, which is wrong, stomping, in which they delete the source code
embedded in the macro and pull only the compiled code.
This is very interesting and it works quite well.
Also, for example, here I am going to launch a document
with a technique...
We are going to see in this tool the macro of these documents.
You see that it has 1, 2, 3, 4, 5 macros.
The code looks good.
It has some cases.
I don't know what happens.
I don't know what else happens.
If this same document that I have there stomped, that I have deleted the source code from the macros, I throw it to this tool, I will only get a macro that is not understood.
Well, it has a code, I have stomped it with that.
If we see the document in more depth, we will see that what I have done precisely is where there were some cases, in this one on the right, you can read the source code perfectly, cases, I don't know, I don't know how much, while here I have crushed it with text.
I have crushed it.
So, VBA stomping has become quite popular.
So much that a tool has been created called Evil Clippy.
Here, well, do you remember any of Clippy?
It seems that it is writing a letter.
Well, here it says, it seems that it is writing a malicious document that does not bypass, that does not elude the antivirus yet.
Do you want me to help you?
And what it does is facilitate all this task of doing the VBA stomping.
It crushes the part of source code and leaves the compiled code.
And it uses a very cool trick of template.
The template makes a call and there you can see what version it has.
Then the server serves you the appropriate document.
It tells you a very, very cool story so you never have to pull from the source code part to compile it and the attacker can effectively launch the macro.
With a database with a lot of documents, I had some doubts if the macros were reused a lot.
The truth is not.
Most are unique.
I mean, number of macros in documents... No, sorry.
This is the number of macros in documents.
Yes, uniqueness.
The majority are unique.
Only 20%, that is, the rest of here, 25%, are reused.
Why?
Because there is a lot of obfuscation and each one is on the fly.
So it is rare to find malicious macros the same.
We also studied some very common characteristics in malware.
The appearance of chains in hexadecimal, in base64, obviously.
And a very curious one, the creation time.
Between the last modification and the document.
We studied the metadata and obviously everything was very...
In real life, it would not take you a second to edit the document, create the macro, etc.
There would be a longer time distance.
As this is fully automated, well, some of these studies confirmed what we believed.
Also, the number of macros in goodware.
Most documents have two macros.
But in malware, in this case, it goes by fashion.
Also because lately I have seen that they have more, the latest ones from Emotet, for example.
When that study was done, they had a single macro.
Let's go to the part that interests me the most, the solutions that are not so difficult.
How is it possible that we have a problem from more than 20 years ago?
And what can we do to avoid it?
Well, they are micro solutions because in my opinion they are quite simple.
Here I show five.
I'm not going to explain this one because it's very complex, but there are tutorials and formulas on the web to activate the PowerShell logs.
PowerShell and macro go very closely together.
So having an adequate visibility of what is happening in PowerShell in the system, what is being executed, allows you to know a lot.
Association of extensions.
You have to trust a lot of...
you don't have to trust the extension, whether it's a doc or a docx.
There is a tool called MEC, you can look it up somewhere, that really associates you if a document is an MCHTA that thinks it's a doc or that tries to deceive you thinking it's a doc, if it's a docm thinking it's a doc.
We can analyze this with the tool that associates you the program according to its magic number, not according to its extension.
And that prevents you from problems .
For example, the RTFs are safer to open them with the WordPad than with the Word.
Because an RTF in the Word is most likely to want to exploit the vulnerability that I mentioned before.
If you open the RTFs in the Word, it's more uncomfortable, but safer.
Evaluate the use of SR that I'm going to tell you now and trust in the AMSI that I'm also going to tell you now.
How to disable the real macros if you don't use them?
Because it's highly likely that you don't use them or never need them.
Well, the only real way that the little button doesn't appear and at the system level, or if you have a network for example, is to download some templates here, a address, copy the ADMs here, and now in gpedit, you will get a new function that would be to block the macro execution.
Without the little button and without anything.
You enable this, and no one will see the little button and it will not run the macros.
At the level of, for example, Active Directory.
Quite useful.
How can you make sure that your system does not open certain types of documents?
For example, the ones I have mentioned, which are 4.0 macros or other extensions.
Well, here in this configuration, both from Excel and Word, in the Confidence Center, file blocking configuration, you can block all these old files that the attackers have rescued.
You can block it from here, to open or save.
You press the button and they will be blocked.
You can no longer open it.
As simple as that.
It is highly unlikely that someone wants to send you a doc, which is actually an .xml, or an .mht, etc.
All these documents I have spoken about, all those formats that are not the real .x, it is highly unlikely that someone will send it to you naturally.
So here you can block them.
It is the configuration of Word itself.
In Excel the same.
The 4.0 formats you can block them here so that they do not open.
And your Excel will no longer open that type of format.
Windows 10 to the rescue.
Windows 10 has been preparing ASRs for a long time.
For now it is only by command line.
They are a kind of recipes for very specific problems.
Only Windows 10 has it.
And it is not in experimentation, but it has been a while that some recipes work better than others.
There are several recipes.
You are not going to learn this here by heart, but you can find out.
There is one thing they did specifically for macros, which is to block all Office if they create a child thread.
That is, if an Office creates a PowerShell or creates a malware, it creates a child process.
To specifically block that type of malware, well, all malwares create a child process, but to avoid that problem in particular, you can do this in PowerShell.
Right now this name is very ugly.
Then it will be a graphic form, I understand.
But it is called...
It is a rule of attack reduction.
You click on Enable, and the Office will not be able to open a child process.
As simple as this.
What happens is that it is not well known.
But it has been for years.
Do not confuse with this.
Do not allow secondary processes to create children.
That maybe you do not know either, but it is in graphic format.
And it is for something else.
It is for the execution of code.
It is the heir of Emet.
Well, this will block functions like this, ShellCMD or the calculator or whatever you want, the simplest ones.
However, it will not be able to stop a very common thing, which is to call it WMC, which is another way to launch code.
But well, now we will see the reaction.
There is another rule, SR, with another different number.
The only thing that differentiates it is this number.
But what is it called?
Blocking API and Win32 calls from Office macros.
What does this mean?
I have shown you some examples.
Have you seen when I did Kernel32?
Well, that can no longer be done if you apply this.
It can no longer be done.
You are loading a lot of macros that need to call Kernel32.
Well, they can no longer call it.
They can no longer have advanced functions.
If you enable it, once you know that this comes out, as if it were Windows Defender, and you can't open the file.
The last one, this one that they put in not so long ago, the ones in lowercase, they put it in less time, and the ones in uppercase do more.
If you put this in, you can no longer call the WMI functions to launch.
That is, with these three rules, you load almost all the basic, essential functionality of a macro so that it stops running.
So that these resources that you need to throw are not available.
Here, this little program is a nonsense that Microsoft did that works badly, very badly, but it works.
Here I am launching tests.
When it blows up, it's because the program really blew up.
Launching tests, and here what I'm going to do is launch the ASR rules.
I'm launching tests, everything works, it creates me a practice of the Office executable, all wrong.
But here I enable this rule, now I'm going to launch it and it will come out that I have blocked it.
I create another rule, I launch another test to see if it can be launched executable from Office, and it will come out that the Defender has stopped it.
Great, it works quite well.
You can do the tests.
Then I told you that they are pulling a lot from memory.
They create in memory with PowerShell binaries that they then launch.
Well, wouldn't it be wonderful to hunt malware in memory?
Antivirus can't do that.
But it turns out that Microsoft has created something called AMSI, which is scanning the memory of PowerShell.
It passes it through the Windows Defender.
This is wonderful because it changes the paradigm we know of antivirus.
And it is something very, very, very revolutionary and quite interesting.
Windows 10 only has it.
It's called AMSI, you already have it activated.
It is only now for PowerShell.
Very recently they are launching it for Office 365 as a whole.
Everything that Office 365 does in memory also passes through Windows Defender.
Are they giving me the lights?
Before playing the disc, I finish.
And a test you can do, if you have AMSI activated, is to do, for example, although you can't see anything here, but a call to Mimikatz with PowerShell.
Before Mimikatz plays the disc, it has already caught it.
Before it plays the disc.
Only when you make the call.
Not later when you load it to the disc and you are going to open it.
And you can see in the logs, you can see that it has done it before playing the disc.
If you have AMSI enabled and if not.
It's brutal.
Right now they are looking to activate it in more places, not just PowerShell.
Not just PowerShell Connect.
Conclusions.
The macros never really left.
They have come back with a lot of strength.
I don't know if to stay, because for example now Office 365, what they are going to do is virtualize it.
Office is going to try, and they are already doing it with Edge, to be able to launch it with Hyper-V in a totally virtual process.
When they do that with Office and it becomes popular, the truth is that a little of what was given is over.
Retrocompatibility is always a problem.
We have more formulas to defend ourselves than we think.
The problem is that we don't know them.
Especially with Windows 10.
Thank you very much.