{"id":12723,"date":"2018-07-02T14:10:06","date_gmt":"2018-07-02T22:10:06","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2018\/07\/02\/news-6491\/"},"modified":"2018-07-02T14:10:06","modified_gmt":"2018-07-02T22:10:06","slug":"news-6491","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/07\/02\/news-6491\/","title":{"rendered":"New macro-less technique to distribute malware"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Mon, 02 Jul 2018 21:12:47 +0000<\/strong><\/p>\n

One of the most common and effective infection vectors, especially for businesses, is the use of malicious Office documents. This year alone, we witnessed two zero-days for both Flash<\/a> and the VBScript engine<\/a>, which were first actually embedded into Office documents before gaining wider adoption in web exploit kits.<\/p>\n

In addition to leveraging software vulnerabilities, attackers are regularly abusing normal Office features, such as macros, or more obscure ones like\u00a0Dynamic Data Exchange<\/a>\u00a0(DDE), and of course Object Linking and Embedding (OLE) attacks, which can also be mixed with exploits<\/a>. System administrators can harden endpoints by disabling certain features company-wide, for example to foil certain social engineering schemes that try to trick users to enable a malicious macro. In recent versions of Office<\/a>, Microsoft is also blocking the activation of objects considered high risk, based on a list of extensions that can be customized via Group Policy.<\/p>\n

But a recent discovery<\/a> by security researcher Matt Nelson<\/a>, shows that yet another infection vector can be tapped into, one that circumvents the current protection settings and even Microsoft’s new\u00a0Attack Surface Reduction<\/a>\u00a0technology. By embedding specially-crafted settings files into an Office document, an attacker can trick a user to run malicious code without any further warning or notification.<\/p>\n

\"\"<\/a><\/p>\n

The file format, specific to Windows 10 called .SettingContent.ms<\/strong>, is essentially XML code that is used to create shortcuts to the Control Panel. This feature can be abused because one of its elements (DeepLink) allows for any binary with parameters to be executed.\u00a0All that an attacker needs to do is add his own command using Powershell.exe or Cmd.exe. And the rest is history.<\/p>\n

\"\"<\/a><\/p>\n

A new script found by Nick Carr<\/a> shows an attack where PowerShell is invoked to download and execute a Trojan (VT report<\/a>). According to Matt Nelson<\/a>, who discovered this new technique, Microsoft is not going to fix it, at least for the time being.<\/p>\n

We tested this sample in our lab and are happy to report that Malwarebytes<\/a> users are already protected:<\/p>\n

\"\"<\/a><\/p>\n

During the past few years, while there has been little development with web exploit kits<\/a>, there has been a lot of activity with document exploit kits such as Microsoft Word Intruder<\/a> (WMI) or Threadkit<\/a>. These toolkits allow attackers to craft lures and embed the exploit(s) of their choice before either spear phishing their victims or sending the file via larger spam campaigns. At the same time, it looks like classic social engineering attacks aren’t going anywhere anytime soon and will keep capitalizing on the human element.<\/p>\n

It is import for end users and businesses to recognize that malicious documents represent a very real threat and require adequate protection and training to fend against.<\/p>\n

The post New macro-less technique to distribute malware<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Mon, 02 Jul 2018 21:12:47 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
The latest macro-less technique to distribute malware via Office documents does not involve exploits. Just a little bit of social engineering.<\/p>\n

Categories: <\/p>\n