3 ms·
For VBA macros, I haven't seen one get past email security in at least a year and half, attackers are favoring Excel 4 macros from what I have seen but I guess
by _8j50 4y ago
For VBA macros, I haven't seen one get past email security in at least a year and half, attackers are favoring Excel 4 macros from what I have seen but I guess for non-big-corporate users VBA macros must still be a problem. Attackers also just put in a link to the malware/archive instead of using a macro but overall this is progress. Signed macro enforcement via GPO would even be better.
For RDP, ugh.... yeah. Lockouts are kind of a problem, I had to deal with this months ago. Lockouts bu themselves are a security issue because availability is a security property. Now, if Microsoft allowed RDP to have OpenSSH like controls about how many failed attempts result in a delay that would be nice. What would be even better would be password policy enforcement especially and specifically for the RDP local group. And password spray protection for domain accounts (if an IP fails login from multiple hosts, temporarily block the IP instead of locking the account). My last wishlist would be public key authentication that is easy to setup like SSH.
You can easily enforce password policy for weak passwords but this lockout policy is useless if they are spraying leaked/known passwords against many accounts, if I understand correctly all you have to do is avoid repeat login attempts for any one account within a 10min window? Which makes it harder but still practical.
- Vindicis 4y agoWhy not just make a simple script to do that? I wrote one in Python ages ago to add up's to the firewall that tried various names, failed # of logins etc... Nothing a few hours of scripting can't solve!
- _8j50 4y agoNot that simple in a bigcorp. A 10 line script is a year long project if someone else does it. I am not a sysadmin or dev, even if i was i don't work for every team with random public facing cloud vms.
- cuteboy19 4y agoBut excel doesn't run macros by default right?
- _8j50 4y agoIt does if you click a button letting it.
- neodymiumphish 4y agoOne of the latest avenues is sending the malicious macros in ISO files masquerading as legitimate documents or zip files. Ideally, email filtering would block that attachment type across the board, but they definitely get by some platforms. What's more is that 7-zip-unpacked files lost their Mark-of-Web, leading to easier execution of malicious scripts as well (although I don't think 7-zip is a significant attack vector in many environments, since it's a non-default option.
- _8j50 4y agoI have had luck with isos as well because motw publisher check isn't done for exe's in them. But unless you have an encrypted zip, our email security will catch it before/after delivery and quarantine it after detonating the iso and its contents. I even tried stuffing the iso with very large files to hit some sort of a limit in automated analysis.