For the past couple of years black hats ranging from North Korean state sponsored hackers
all the way to script kiddies have been exploiting a legacy feature in microsoft office which
dates way back to 1992 - using it to weaponize innocent word and excel documents which hack
unsuspecting victims.
The scheme is simple, usually a victim receives a harmless looking excel spreadsheet in a
phishing email from someone pretending to be their bank, a Nigerian prince, the cover
story could be anything. Unbeknownst to the user it contains a hidden surprise - in this
example the document claims there’s some kind of compatibility issue, and that to resolve
it you need to hit the “enable content” button. But in reality, tapping this button
will pwn your PC. By “enabling content” a victim is allowing the document to run malware
hidden within an excel macro.
Macros are a legitimate feature in excel - which have recently become a big big problem. They
allow you to store boring excel tasks within shortcuts. For example, I’ve made a macro
which executes when I hit Ctrl and X, it’ll take whatever cell is selected and give it
a yellow background and bold white text. I know what you’re thinking - seytonic this
is an awful design decision, you can hardly even read what it says - that’s not the
point, the the point is macros are stored as visual basic code, so it’s not difficult
for a bad actor to insert malicious code - to execute some powershell command, download
and execute more malware, use your imagination.
This is exactly how North Korean hackers attempted to hack Russian companies, an excel doc delivered
by email claimed to have compatibility issues, clicking “enable content” would download
and execute a second stage payload from dropbox. Pwning the company’s network, allowing the
North Koreans to do their espionage, as you do.
Microsoft has recognised that macros can and are used for evil, so when you open a document
that contains one you have to enable it manually for it to run. Which is fine, except for the
fact that blackhats are creative. In this example the doc claims it’s encrypted and
that clicking “enable content” will decrypt the file. To you or I, this is obvious BS
- but to Karen bot in accounting it looks somewhat believable. And unfortunately the
“security warning” microsoft put right next to the button rarely deters people. I
mean, the doc does claim to be “100% virus free” so it must be… right? Of course
they make this whole message look like some kind of system message or pop up, when in
reality it’s literally just text in an excel document with a green background trying to
convince you to click that little button.
Macros were introduced to excel way back in 1992, since then they’ve gone relatively
unexploited by cybercrooks. All that changed in 2020, when we saw a massive spike in criminals
using macros as a vector to propagate their evil wares. Since then criminals have been
using them like crazy. This is where Microsoft has stepped in to save the day, well kind
of. You see there’s two types of these excel macros, the more modern ones written in visual
basic - if it’s even possible to put modern and Visual Basic in the same sentence, but
relatively so when compared to XLM macros, the other kind.
XLM macros are ancient, barely anyone uses them apart from a few companies which haven’t
bothered to migrate over. In fairness they haven’t had long, it’s only been 30 years
or so. When malicious macros are written in XLM they quite often make it past antivirus
software simply because the technology is so old that malware detection systems aren’t
designed to detect it. Criminals really like this, because of course they do. In fact,
criminals like this so much that about 90% of all XLM macros in use today are malicious
according to research by reversing labs. It’s taken Micrososft a while to address the issue,
but they’ve now clocked on and are going to disable these XLM macros once and for all
in an upcoming update.
Visual basic macros though are sticking around, so the overall macro threat is only somewhat
diminished.
This video is sponsored by roboForm. The easiest thing you can do to level up your security
is use a password manager. Roboform keeps your passwords encrypted until you need them
and notifies you if any of your passwords have been included in a data breach helping
you stay secure. Roboform is one of the og-est password managers, they’ve been around since
the 90’s - I also use them myself.
Use the link in the description to grab 30% off an annual subscription, bringing it to
just $16, and there’s a 30 day refund policy if you aren’t happy with roboform for any
reason.
If you enjoy this kind of video make sure to help me out by mutilating the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on the
massive twitch hack.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.