A while ago, I talked about how malware creators have gotten a lot more clever recently,
ever since Microsoft disabled macros by default in Office, which was a previous very common
vector for malware. And instead, they've started using lesser known file types that
the average person is not very familiar with to spread these viruses, such as ISO files.
But they have continued to switch it up, and the latest file type they've started
using are OneNote files. And some of them even employ a technique that is so crazy,
I probably would have even fallen for it myself, I'd never heard of it before. So in this video,
I'll talk about what they're doing now, how to spot it, and how to defend against it.
So here's how the latest attack works. They spread the files the normal way,
through an email, typically saying, here's an invoice. Or it may even be seasonal saying,
here's a Christmas bonus going to workers, something like that. And the attached file
type will be ".one" file, which is a OneNote file. And OneNote, if you're not familiar,
it's an app published by Microsoft that is effectively a note-taking app,
but you can create all sorts of tabs and post images and stuff like that, it's not just text.
But the key here is OneNote actually allows someone to attach files within the OneNote
document itself, and in this case malware creators are putting malicious files attached to it. But
at this point in time at least, opening the OneNote file is not enough to get infected,
so hackers need you to actually run the script or executable by clicking on it somehow.
So the clever way they've come up with is to basically have a fake button and it says something
like, "Click here to view document," and there's a fake image of a blurred out document behind it.
But if you do click it, then that actually runs the malicious file. Now OneNote, if you do click
to open an attachment, it will pop up a box and give you a warning that opening attachments could
harm your computer, and this is basically your last chance to avoid getting infected.
But a lot of people just click through it. Now before I get into what happens if you fall for it,
let me tell you about today's sponsor, which is pretty relevant, and that is
Acronis Cyber Protect Home Office, formerly known as Acronis True Image. No longer just for backup,
Acronis Cyber Protect combines backup and anti-malware into one solution.
It's simple to manage from a single interface, so not only saves you time and reduces complexity,
but also costs as much as 55% less than multiple standalone solutions together. These days,
malware often targets backups as well, so Acronis allows for peace of mind that your data is
safe and recoverable. And is even accessible from anywhere, different places and devices,
with Acronis Cloud Backup included with the advanced and premium subscriptions.
And I like how you're able to add your own encryption password to your backups,
so only you would ever be able to access your backups, not even Acronis themselves.
I also like all the useful tools it comes with, such as a disk cloner,
which is great if you're upgrading a drive and want to copy everything over.
There's a drive cleanser to securely wipe a disk, as well as a rescue media builder for recovering
if your OS becomes totally unbootable. Plus there's a bunch of other tools and features like
folder syncing, archiving large or old folders, and custom backup options not just for backing
up your whole PC, but also individual files and folders, or selected disks and partitions.
And as a special deal, if you want to get 30% off Acronis Cyber Protect Home Office,
click the link in the description and enter the code "ThioJoe2023" at checkout. And with
all that being said, let's continue. So what happens if you do fall for it? Well,
there might be a number of different file types that you're actually running that's malicious.
A lot of times it's a VBS script or even a LNK file, which is effectively a shortcut,
and then it will run some kind of command. Typically the command will tell the computer
to download a file from some URL, and that's the actual viral payload. So that's how they
try to get around antivirus and initial detection, is the file itself doesn't
necessarily have a virus in it, but it has a command that then goes and gets that virus.
And meanwhile, the script will also probably open up some kind of document as a decoy.
So the person thinks that they just opened up a document, not realizing
the malicious script is going on in the background doing other stuff. And in terms
of what it actually downloads and infects you with, it could be absolutely anything.
A lot of times it's a remote access Trojan or RAT, which can pretty much do whatever it wants on your
computer. Anything from stealing passwords, even to taking screenshots, stealing browser cookies,
or adding your computer to a botnet so it can do other attacks, or likely all of the above. Now,
I don't want to get into the super specific technicals of how these scripts work,
but I was reading about one technique that they use that I had no idea was even possible.
Apparently at some point, one of these viruses may download a file that uses
a special Unicode character called a right-to-left override, or RTLO.
And this character tells the OS to display any characters after that in reverse order,
like for languages that read from right to left. However, this can be used to very convincingly
spoof a file extension, because it moves the real file extension over and then you can
display any other text, some other arbitrary file extension that may not look malicious.
So for example, even though I have file extensions enabled,
they could add this character and some text. So instead of looking like virus.exe,
which is the actual file name, they could rename it and add some characters. So it
would be virus.exe.docx or something like that. And it's actually an executable.
The actual file extension is still.exe, but it's displayed as .docx. And even if you go
to rename it, you don't realize that it's all rearranged and reordered. So it 100%
looks like it's a .docx file, but it's not. So if you have file extensions on, like I do,
and you see an innocuous file extension, like a text file or even an image file type,
you might think that means you're safe to click and see what it is, even though it's not.
And what they could also do is just change the icon of the executable to be anything.
So it'll look like the proper icon of what that file extension should be. So you might not ever
know until you click it. I had no idea this was possible before researching this video.
And I actually did make a dedicated video about it that I've already released ahead of this.
So check that out if you want more details. But this is a trick that I probably would
have fallen for myself. And this just goes to show that you should absolutely
never download or run any kind of suspicious files or attachments,
no matter whether you think you know what type of file it is or not, because you apparently can't.
Anyway, going back to the main topic of the video with the OneNote files,
I did an example to show you more clearly how this infection works. So I made this
OneNote file myself. This is not malicious, I made this from scratch. And you can see that
with an attachment, if you double click it, it gives you the warning and then it opens.
This is just an image, but if it was a script, it would run the script. You
can also see an attachment could just be a shortcut. So this is one I made,
and this simply opens the command prompt and says some text. So I can simply copy
and paste it in or whatever. It'll ask to attach it. And now when I double click and
run it, you can see it says, "Oh no I ran a script," but this could have been anything.
Then on the right hand side, you can see an example where there's apparently a
blurred out document behind this button. But in reality, it's just an image of a
random document that I blurred. It's not a real document. Then there's this button
and notice how if I move it, behind it, there are a bunch of little icons for attachments.
And this is because for whatever reason in OneNote, if you double click an image,
but there's an attachment behind it, it actually clicks through the image
as if you had clicked on the attachment directly. So what these hackers have done
is put a bunch of attachments in a row. So no matter where you click on the button,
you don't actually click the button, but one of those attachments to run.
So yeah, extremely clever. They never cease to amaze me. Now in terms of the
best ways to defend against this attack, as expected in this case, it's simply best to
just know about it. And then if you see .one extension come through as an email attachment,
don't click it, report it to your IT department if you're working at a company,
and maybe even suggest that they just block these .one files altogether from coming through,
because I don't think most people are sending OneNote attachments.
I believe I read that it's actually not very easy to create this .one [file].
You have to actually go through a lot of complicated steps. So it's not like anyone
would legitimately be sending this type of file. It's not something you can create
regularly with the program. So maybe send the IT department some articles about this.
And if you're the IT department yourself, then maybe start blocking
this from coming through in emails. So anyway at least now you know,
and you should be able to guard against it or potentially any small variations that they
make in the future for this. If you enjoyed this video, be sure to give it a thumbs up.
Let me know down in the comments if you have seen this type of malicious extension before.
Maybe you didn't know how it worked before, and now you do. Thanks again to Acronis for
sponsoring this video. Again, be sure to check out the link in the description and
get 30% off Acronis Cyber Protect Home Office by using the code ThioJoe2023 at checkout.
If you want to keep watching, the next video I'd recommend is one I
made about new scams this year. I make one every year and they never cease to
amaze me about the new stuff they come up with. So I'll put that link right there,
you can just click on it. Thanks so much for watching, and I'll see you in the next one.