Tip: Adobe Reader Lets You Open Any Embedded Files

In recent weeks, cyber criminals several times PDF files sent which was hiding a malicious Word document. Once users opened the PDF file they were asked if they wanted to open the embedded Word document.

The Word document contains another macro that installed malware on the computer. The macro is executed only if users set it, but in practice this is an effective method of attack. Users and administrators can easily avoid, however, Adobe Reader opens these embedded documents, says Didier Stevens, handler at the Internet Storm Center. Through the Trust Manager, available via the settings of the PDF reader option can be switched off, as Stevens Also in this video shows.

Macro-Malware Steals Thousands Of Documents From Companies

From late February to mid-March, assailants carried out a campaign macro malware was used to steal passwords and documents thousands of businesses. The attack began with an e-mail contained a Word document. In the document were hidden macros that, when activated by the receiver, malware installed.

Via this malware were then the credentials of workers and business documents stolen. According to anti-virus firm Kaspersky Lab , the attackers managed to steal a total of 10,000 documents of companies, mainly from Thailand and India, although Belgian companies were targeted. In addition, also found thousands of stolen credentials, coming from hundreds of infected computers. By looking at the stolen credentials, according to the virus fighter very clear that workers malware statements sent to each other, since the host names and internal applications were the same.

Cisco Raises The Alarm For Advancing Macro-Malware

In half a year, the number of attacks doubled through macro-malware, network giant Cisco reason to sound the alarm. The malware is distributed via e-mail attachments that contain Word documents. Once the document is opened, the user is asked whether he wants to enable macros, because Microsoft has it turned off by default for security reasons.

According to Tim Gurganus Cisco, many people forget and turn the threat of macros then, so the malicious code in the document to download and install malware. A successful approach, as evidenced by the increase in the number of e-mail attacks macro-malware is used. The problem is compounded because most email filters and business office documents and not block the malicious macro code geobfusceerd and is very difficult to detect.

The first malicious macros were still out of 150 lines of code, which have now been there in 1500. The makers have all kinds of measures taken to avoid detection and the tactics in the field of social engineering refined. Thus allowed to open a blank page after the first copies, which could alert users that something was wrong. Since early this year "distraction Documents" displayed while in the background the infection takes place. Consequently, users will not suspect that it is malware.

It also appears that the attackers regularly hacked legitimate websites or cloud services like Dropbox, Google Drive or Pastebin.com use to host the malware. The big advantage is that the domains do not stand out in traffic and will not be blocked soon. "Macro-malware is also a good example of malware makers who respond severely becoming security measures, such as blocking zip files containing .exe files. Attackers continue to adapt their tactics, techniques and procedures," said Gurganus.

Microsoft Provides Alarm About Macro-Malware

To perform asking Internet users if they macros in Office documents so that their computer is infected with malware is a very successful method for cyber criminals, as the past few months more than half a million computers were infected in this way.

The malware is distributed via e-mails with subjects about bills, taxes, delivery confirmations, CVs and donation confirmations. Topics according to Microsoft, users can easily mislead to open the email and attachment without piggybacked hereby thinking. Once the macro is executed will download a file which then downloads a Trojan downloader. This downloader installs additional malware on the system. The software giant sets raises the question of how this form of social engineering can be combated.

In the case of enterprises, system administrators can take various measures. Most macro malware namely located in the .doc format used in Office 2007 and earlier. Administrators can set up via the Trust Center of Office that documents from earlier Office versions are not loaded. In addition, the operation of macros in Office can be configured , for example, to allow only digitally signed macros or block all macros.

Macro Malware Infected Computer By Closing Document

Researchers have discovered a new macro malware that infects your computer only if the document is closed, to circumvent detection. The malware looks to the presence of certain sandboxes like Sandboxie sandbox and Anubis. Macros allow users to automate various tasks and were used years back on a large scale by malware. Because of the security risks, Microsoft decided therefore to block macros by default in Office.

A year ago, appeared more and more .doc and .xls documents containing macros were hidden. The documents users were summoned to enable macros. Once the user enables the macro is the background example, it downloaded and installed malware. At least, that is the expected behavior.

A new variant of the Dridex malware downloads the malware until the user closes the document. According to security firm Proofpoint hope to bypass the malware creators this virus scanners and intrusion detection systems that monitor when opening documents loading malware. For this type of behavior to prevent their detection systems have security sandboxes and adapted to "wait" longer any malicious activity.

"The possibility of malicious macros to perform as the document is closed increases the infection window and forces a detection sandbox to monitor longer and possibly miss the infection. How long sandbox also wait, the infection will not occur, and if the sandbox closes or stops without closing the document, the infection is missed as a whole, " said the researchers from Proofpoint.

Sandbox

Also security PhishMe warns of a variant of Dridex that spreads via macros. This variant looks specifically at the presence of certain sandboxes like Sandboxie sandbox and Anubis. In case these sandboxes are detected, the computer will not be infected. Is the attack or successful, then download the macro Dridex banking Trojan on the computer. This malware is specially designed to steal money from online bank accounts.