3 ms·

Where is the scary warning about macros within the document? I thought that macros are not executed by default, and you must trust the source for executing the

Where is the scary warning about macros within the document? I thought that macros are not executed by default, and you must trust the source for executing the macros. I am not trying to downplay it, it's still a privilege escalation. But is triggering it via Word macros in any way special? edit: At my work computer, the setting is "disable all macros with notification". I suspect, but I am not sure that this is the default for a fresh Office install. With this setting running macros on a random Word document is not much different than running a random .exe file. Of course, privilege escalation is equally serious in both cases.

iueotnmunto 4y ago
Macros use ZoneInfo NTFS hidden properties to determine the source of the document (local, trusted, internet, etc). I'm unsure of the default for local, but internet downloaded macros are prompt by default. Group policy can be used to explicitly deny or globally permit. I believe there's also the ability to cryptographically sign macros if required.
mschuster91 4y ago
Given how many organizations run on widely shared Excel sheets with shitloads of macros someone wrote thirty years ago, it makes sense to use Excel sheets as a spreader mechanism. Basically, a multi-stage hack: 1) Get RCE on an user's computer in some way (e.g. via a browser exploit chain, yet another exploit in a public reachable Citrix instance, tech support scam) 2) Scan the MRU lists of all users for Excel files on network drives, Onedrive, Dropbox and other common share tools 3) Once the files become accessible (e.g. because the user connected to the VPN), open each file and check if it has macros. If yes, inject spreader payload (e.g. a credential stealer, a miner or a crypter). If no, continue to the next file. 4) Other users now open these Excel files, execute the macros because they expect to be asked that question, and now the payload executes.
INTPenis 4y ago
Oh yeah I agree. We had a couple of horrendous systems made with Excel and VBS about 10 years ago and in order to work with them I had to enable and disable all sorts of stuff before I could work freely. On my work computer of course. I believe there are best practices for office computer security policy.
deleted 4y ago
[deleted]

iueotnmunto 4y ago

Macros use ZoneInfo NTFS hidden properties to determine the source of the document (local, trusted, internet, etc). I'm unsure of the default for local, but internet downloaded macros are prompt by default. Group policy can be used to explicitly deny or globally permit. I believe there's also the ability to cryptographically sign macros if required.

mschuster91 4y ago

Given how many organizations run on widely shared Excel sheets with shitloads of macros someone wrote thirty years ago, it makes sense to use Excel sheets as a spreader mechanism. Basically, a multi-stage hack: 1) Get RCE on an user's computer in some way (e.g. via a browser exploit chain, yet another exploit in a public reachable Citrix instance, tech support scam) 2) Scan the MRU lists of all users for Excel files on network drives, Onedrive, Dropbox and other common share tools 3) Once the files become accessible (e.g. because the user connected to the VPN), open each file and check if it has macros. If yes, inject spreader payload (e.g. a credential stealer, a miner or a crypter). If no, continue to the next file. 4) Other users now open these Excel files, execute the macros because they expect to be asked that question, and now the payload executes.

INTPenis 4y ago

Oh yeah I agree. We had a couple of horrendous systems made with Excel and VBS about 10 years ago and in order to work with them I had to enable and disable all sorts of stuff before I could work freely. On my work computer of course. I believe there are best practices for office computer security policy.

deleted 4y ago

[deleted]