Attacks/Breaches

6/9/2016
05:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

US-CERT Warns Of Resurgence In Macro Attacks

Organizations and individuals urged to be proactive in protecting against threat from the 90s.

The recent resurgence in the use of macros to distribute malware on Windows machines has become enough of a worry to prompt the US-CERT to issue an advisory reminding organizations of the threat.

In a brief alert this week, US-CERT urged individuals and organizations to proactively secure systems against what it described as an increase in malware that is being spread via macros and to refer to Carnegie Mellon CERT's blog post on macros.

“Macro viruses are back,” CMU's CERT senior vulnerability analyst Will Dormann wrote. He pointed to the continued reliability of the exploit and weaknesses in the user interface of Microsoft Office as reasons for the renewed interest in such attacks.

“Malicious Microsoft Office documents that leverage macros are exploiting capabilities that are provided by Microsoft Office by design,” Dormann said. The best way for organizations to mitigate the issue is to disable Microsoft Office macros enterprise-wide to the extent possible and to implement new controls for systems that do require macros.  

“If you wish to protect your systems, restrict access to macros. Regardless of the level of information provided to an end-user, don't always rely on that user to make the right choice,” Dormann cautioned.

Macros are basically pieces of code written in Visual Basic for Applications (VBA) that allows users to automate frequently used tasks in Word, PowerPoint, Excel and other Microsoft Office apps. Macros are typically used to speed up certain common tasks like formatting a document, inserting a table with pre-specified dimensions into a document or filling in forms.

Back in the 1990s and early 2000’s, rogue macros written from scratch using VBA and inserted into Word documents and other files, were a favorite tool for attackers to distribute malware. Many malware samples from that era leveraged macros to spread, most notably the Melissa virus, which some consider as one of the most widely distributed macro infections ever.

“Macro malware became almost extinct after Microsoft disabled VBA macros by default in Office applications,” several years ago, says Deepen Desai, director of research at security vendor Zscaler. However, with modern attacks increasingly targeting end users and endpoint systems, there has been a steady resurgence in the use of macro malware, Desai tpld Dark Reading.

Examples of recent attacks involving the use of macros include a campaign targeting point of sale systems at some 100 organizations and the attack on the power grid in Ukraine. Documents containing malicious macros have also been used widely to distribute ransomware samples like Locky and CryptoWall and banking Trojans like Dridex.

In many cases, attackers are able to slip past default security settings by using social engineering tactics to get users to enable macros, Desai says. Increasingly, attacks involving the use of macros have begun getting more sophisticated and difficult to detect. “First, they made these macros highly obfuscated and difficult to read or detect,” he says. "Subsequently, they started leveraging different functions of VBA language to make the detection even more difficult by traditional as well as automated analysis systems like sandboxes.”

Earlier this year, Microsoft itself noted that 98% of threats targeting Office over the last year involved the use of macros. In a TechNet blog post, Microsoft blamed the “enduring appeal” for macro attacks on the continuing tendency by users to enable macros that have been disabled by default on their systems.

In response, the company has released a new feature in Office 2016 that make it harder for users to enable macros, gives them more notification about the potential security threats associated with macros and gives administrators greater control over the use of macros in an enterprise setting.

In his blog post, CERT’s Dormann laid at least some of the blame to date on the manner in which Microsoft has chosen to warn users about the dangers of macro use over the years. Starting with very clear and explicit warnings in earlier versions of Office, Microsoft’s notifications pertaining to the dangers of enabling macros have become less informative, he said.

Though Microsoft offers guidance on how to restrict macro functionality users of newer versions of Office are actually more likely to enable macros than previously without understanding the consequences, he said.

His recommendations for mitigating the threat included disabling macros wherever possible, enabling macros only for specific apps as needed and allowing only signed macros to run.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10008
PUBLISHED: 2019-04-24
Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login a...
CVE-2019-9950
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an authentication bypass vulnerability. The login_mgr.cgi file checks credentials agains...
CVE-2019-9951
PUBLISHED: 2019-04-24
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php...
CVE-2018-10055
PUBLISHED: 2019-04-24
Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
CVE-2018-7577
PUBLISHED: 2019-04-24
Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.