Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/9/2016
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

US-CERT Warns Of Resurgence In Macro Attacks

Organizations and individuals urged to be proactive in protecting against threat from the 90s.

The recent resurgence in the use of macros to distribute malware on Windows machines has become enough of a worry to prompt the US-CERT to issue an advisory reminding organizations of the threat.

In a brief alert this week, US-CERT urged individuals and organizations to proactively secure systems against what it described as an increase in malware that is being spread via macros and to refer to Carnegie Mellon CERT's blog post on macros.

“Macro viruses are back,” CMU's CERT senior vulnerability analyst Will Dormann wrote. He pointed to the continued reliability of the exploit and weaknesses in the user interface of Microsoft Office as reasons for the renewed interest in such attacks.

“Malicious Microsoft Office documents that leverage macros are exploiting capabilities that are provided by Microsoft Office by design,” Dormann said. The best way for organizations to mitigate the issue is to disable Microsoft Office macros enterprise-wide to the extent possible and to implement new controls for systems that do require macros.  

“If you wish to protect your systems, restrict access to macros. Regardless of the level of information provided to an end-user, don't always rely on that user to make the right choice,” Dormann cautioned.

Macros are basically pieces of code written in Visual Basic for Applications (VBA) that allows users to automate frequently used tasks in Word, PowerPoint, Excel and other Microsoft Office apps. Macros are typically used to speed up certain common tasks like formatting a document, inserting a table with pre-specified dimensions into a document or filling in forms.

Back in the 1990s and early 2000’s, rogue macros written from scratch using VBA and inserted into Word documents and other files, were a favorite tool for attackers to distribute malware. Many malware samples from that era leveraged macros to spread, most notably the Melissa virus, which some consider as one of the most widely distributed macro infections ever.

“Macro malware became almost extinct after Microsoft disabled VBA macros by default in Office applications,” several years ago, says Deepen Desai, director of research at security vendor Zscaler. However, with modern attacks increasingly targeting end users and endpoint systems, there has been a steady resurgence in the use of macro malware, Desai tpld Dark Reading.

Examples of recent attacks involving the use of macros include a campaign targeting point of sale systems at some 100 organizations and the attack on the power grid in Ukraine. Documents containing malicious macros have also been used widely to distribute ransomware samples like Locky and CryptoWall and banking Trojans like Dridex.

In many cases, attackers are able to slip past default security settings by using social engineering tactics to get users to enable macros, Desai says. Increasingly, attacks involving the use of macros have begun getting more sophisticated and difficult to detect. “First, they made these macros highly obfuscated and difficult to read or detect,” he says. "Subsequently, they started leveraging different functions of VBA language to make the detection even more difficult by traditional as well as automated analysis systems like sandboxes.”

Earlier this year, Microsoft itself noted that 98% of threats targeting Office over the last year involved the use of macros. In a TechNet blog post, Microsoft blamed the “enduring appeal” for macro attacks on the continuing tendency by users to enable macros that have been disabled by default on their systems.

In response, the company has released a new feature in Office 2016 that make it harder for users to enable macros, gives them more notification about the potential security threats associated with macros and gives administrators greater control over the use of macros in an enterprise setting.

In his blog post, CERT’s Dormann laid at least some of the blame to date on the manner in which Microsoft has chosen to warn users about the dangers of macro use over the years. Starting with very clear and explicit warnings in earlier versions of Office, Microsoft’s notifications pertaining to the dangers of enabling macros have become less informative, he said.

Though Microsoft offers guidance on how to restrict macro functionality users of newer versions of Office are actually more likely to enable macros than previously without understanding the consequences, he said.

His recommendations for mitigating the threat included disabling macros wherever possible, enabling macros only for specific apps as needed and allowing only signed macros to run.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
A Lawyer's Guide to Cyber Insurance: 4 Basic Tips
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  7/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13951
PUBLISHED: 2019-07-18
The set_ipv4() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv4 address in zone data.
CVE-2019-13952
PUBLISHED: 2019-07-18
The set_ipv6() function in zscan_rfc1035.rl in gdnsd 3.2.0 has a stack-based buffer overflow via a long and malformed IPv6 address in zone data.
CVE-2019-10100
PUBLISHED: 2019-07-18
The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack v...
CVE-2019-10102
PUBLISHED: 2019-07-18
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/devel...
CVE-2019-10102
PUBLISHED: 2019-07-18
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically ...