Macros and malware spooky

whoami Niall Watson @Nige0x 4th year VP Slight alcoholic Malware Hater of big words

Macros Small programs within Office documents Used to automate repetitive tasks in office documents Can save you a lot of time Written in Visual Basic for Applications(VBA) Can use them maliciously

Macros as an infection vector Malware needs a way to infect a system Usual ways: Email USB Dodgy programs Macros now

Who uses these?

Who uses this method? Russian dudes Nation States Malware authors Dridex Cryptolocker Powersniff TeslaCrypt List goes on...

No point wasting exploits when you can use an MS office document Who would this target? Attack doesn't need to be complex Perfect to use against office workers Political activists Ukrainian power grid BlackEnergy No point wasting exploits when you can use an MS office document

How do they use them maliciously? Create a nice pretty document Nice pretty name, with made up data Code some malicious macros Send it to a bunch of users Hope some dumbass opens it

What happened? So the clever user has opened our nice document Clicked on enable content Voila they can see our nice employee wages. Oh no

Demo

Mitigations Turn off macros. Don't open unknown office docs Run through sandbox

Questions?