Attacks/Breaches
6/9/2016
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

US-CERT Warns Of Resurgence In Macro Attacks

Organizations and individuals urged to be proactive in protecting against threat from the 90s.

The recent resurgence in the use of macros to distribute malware on Windows machines has become enough of a worry to prompt the US-CERT to issue an advisory reminding organizations of the threat.

In a brief alert this week, US-CERT urged individuals and organizations to proactively secure systems against what it described as an increase in malware that is being spread via macros and to refer to Carnegie Mellon CERT's blog post on macros.

“Macro viruses are back,” CMU's CERT senior vulnerability analyst Will Dormann wrote. He pointed to the continued reliability of the exploit and weaknesses in the user interface of Microsoft Office as reasons for the renewed interest in such attacks.

“Malicious Microsoft Office documents that leverage macros are exploiting capabilities that are provided by Microsoft Office by design,” Dormann said. The best way for organizations to mitigate the issue is to disable Microsoft Office macros enterprise-wide to the extent possible and to implement new controls for systems that do require macros.  

“If you wish to protect your systems, restrict access to macros. Regardless of the level of information provided to an end-user, don't always rely on that user to make the right choice,” Dormann cautioned.

Macros are basically pieces of code written in Visual Basic for Applications (VBA) that allows users to automate frequently used tasks in Word, PowerPoint, Excel and other Microsoft Office apps. Macros are typically used to speed up certain common tasks like formatting a document, inserting a table with pre-specified dimensions into a document or filling in forms.

Back in the 1990s and early 2000’s, rogue macros written from scratch using VBA and inserted into Word documents and other files, were a favorite tool for attackers to distribute malware. Many malware samples from that era leveraged macros to spread, most notably the Melissa virus, which some consider as one of the most widely distributed macro infections ever.

“Macro malware became almost extinct after Microsoft disabled VBA macros by default in Office applications,” several years ago, says Deepen Desai, director of research at security vendor Zscaler. However, with modern attacks increasingly targeting end users and endpoint systems, there has been a steady resurgence in the use of macro malware, Desai tpld Dark Reading.

Examples of recent attacks involving the use of macros include a campaign targeting point of sale systems at some 100 organizations and the attack on the power grid in Ukraine. Documents containing malicious macros have also been used widely to distribute ransomware samples like Locky and CryptoWall and banking Trojans like Dridex.

In many cases, attackers are able to slip past default security settings by using social engineering tactics to get users to enable macros, Desai says. Increasingly, attacks involving the use of macros have begun getting more sophisticated and difficult to detect. “First, they made these macros highly obfuscated and difficult to read or detect,” he says. "Subsequently, they started leveraging different functions of VBA language to make the detection even more difficult by traditional as well as automated analysis systems like sandboxes.”

Earlier this year, Microsoft itself noted that 98% of threats targeting Office over the last year involved the use of macros. In a TechNet blog post, Microsoft blamed the “enduring appeal” for macro attacks on the continuing tendency by users to enable macros that have been disabled by default on their systems.

In response, the company has released a new feature in Office 2016 that make it harder for users to enable macros, gives them more notification about the potential security threats associated with macros and gives administrators greater control over the use of macros in an enterprise setting.

In his blog post, CERT’s Dormann laid at least some of the blame to date on the manner in which Microsoft has chosen to warn users about the dangers of macro use over the years. Starting with very clear and explicit warnings in earlier versions of Office, Microsoft’s notifications pertaining to the dangers of enabling macros have become less informative, he said.

Though Microsoft offers guidance on how to restrict macro functionality users of newer versions of Office are actually more likely to enable macros than previously without understanding the consequences, he said.

His recommendations for mitigating the threat included disabling macros wherever possible, enabling macros only for specific apps as needed and allowing only signed macros to run.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Malware Incidents Hit 100% of Businesses
Dawn Kawamoto, Associate Editor, Dark Reading,  11/17/2017
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.