{"id":1095,"date":"2017-10-23T07:30:54","date_gmt":"2017-10-23T11:30:54","guid":{"rendered":"http:\/\/www.webcommand.net\/?p=1095"},"modified":"2017-10-20T10:48:19","modified_gmt":"2017-10-20T14:48:19","slug":"virus-email-reminder-word-macros-bad","status":"publish","type":"post","link":"https:\/\/www.webcommand.net\/index.php\/2017\/10\/23\/virus-email-reminder-word-macros-bad\/","title":{"rendered":"Virus Email Reminder – Word Macros Are Bad!"},"content":{"rendered":"

I had a couple of users in the office this week attempt to enable word macros on a document they received in email. I try to give my users as much information as I can to avoid viruses and malware, but each week the hackers come up with additional methods to attempt unauthorized network access.<\/p>\n

Exploit Vector:\"\"<\/h4>\n

This time around the hack was email based and the email came from a known\u00a0 source.\u00a0 The attacker has already gained control of the senders workstation and had sent the message as a reply to an earlier thread.<\/p>\n

Example:<\/h4>\n
    \n
  1. Client sends me a legitimate message:<\/strong>
    \nTO: Joe@xyz.com
    \nFROM: Sam@abc.com
    \nSUBJECT: Business Dinner
    \nBODY: Joe can you come to dinner tonight<\/p>\n
    \n<\/li>\n
  2. I reply to client<\/strong>
    \nTO: Sam@abc.com
    \nFROM:Joe@xyz.com
    \nSUBJECT: RE:Business Dinner
    \nBODY: Sorry can’t make it————
    \nTO: Joe@xyz.com
    \nFROM: Sam@abc.com
    \nSUBJECT: Business Dinner
    \nBODY: Joe can you come to dinner tonight<\/p>\n
    \n<\/li>\n
  3. Hacker now intercedes in the email thread<\/strong>TO: Joe@xyz.com
    \nFROM: Sam@abc.com
    \nSUBJECT: RE:Business Dinner
    \nBODY: I have a proposal for you. Please see attached and confirm.
    \n———————–
    \nTO: Sam@abc.com
    \nFROM:Joe@xyz.com
    \nSUBJECT: RE:Business Dinner
    \nBODY: Sorry can’t make it<\/p>\n

    ————
    \nTO: Joe@xyz.com
    \nFROM: Sam@abc.com
    \nSUBJECT: Business Dinner
    \nBODY: Joe can you come to dinner tonight<\/li>\n<\/ol>\n

    As you can see for the above interaction, the firs two messages in the email thread are legitimate and then the hacker inserts a second reply with the attached Word document and virus payload. This would indicate the hacker has full control of the users PC. Also after reviewing the email message headers, it was clear that the sending server was the originators server.<\/p>\n

    \"\"<\/p>\n

    Viral Payload:<\/h6>\n

    The intent of this attack is to have a user open a Word document and execute the macros launching the viral payload. Word has become more secure over the years and now requires user intervention to “Enable Macros” I can’t stress enough unless you are 100% sure or created them yourself, macros are almost always BAD! Don’t\u00a0 do it.<\/p>\n

    Below is what the Word Document looks like<\/p>\n

    \"\"<\/a>If you made it this far you’re not paying enough attention to your email messages. However there are some hints here that should tip you off that this is an attack.<\/p>\n