1. Macros and malware
spooky

2. whoami Niall Watson @Nige0x 4th year VP Slight alcoholic Malware
Hater of big words

3. Macros Small programs within Office documents
Used to automate repetitive tasks in office documents
Can save you a lot of time
Written in Visual Basic for Applications(VBA)
Can use them maliciously

4. Macros as an infection vector
Malware needs a way to infect a system
Usual ways:
USB
Dodgy programs
Macros now

5. Who uses these?

6. Who uses this method? Russian dudes Nation States Malware authors
Dridex
Cryptolocker
Powersniff
TeslaCrypt
List goes on...

7. No point wasting exploits when you can use an MS office document
Who would this target?
Attack doesn't need to be complex
Perfect to use against office workers
Political activists
Ukrainian power grid
BlackEnergy
No point wasting exploits when you can use an MS office document

8. How do they use them maliciously?
Create a nice pretty document
Nice pretty name, with made up data
Code some malicious macros
Send it to a bunch of users
Hope some dumbass opens it

9. What happened? So the clever user has opened our nice document
Clicked on enable content
Voila they can see our nice employee wages. Oh no

11. Demo

12. Mitigations Turn off macros. Don't open unknown office docs
Run through sandbox

13. Questions?