Attack Via Office DDE Feature Also Works In Microsoft Outlook

The Microsoft Office DDE feature currently used to attack Internet users through Word documents also works in Microsoft Outlook, so researchers have shown. The attack can be performed by sending emails and calendar invitations set up in Rich Text Format (RTF).

The Dynamic Data Exchange (DDE) feature of Microsoft Office makes it possible to inject data from, for example, an Excel document into a Word document. This will add code to one document that points to the data in the other document. Instead of a document, malicious code may also be linked. Attackers now use this feature to infect internet users through Word documents with ransomware and other malware.

The attackers send emails that have attached a Word document. As soon as the recipient opens the document, he will see several dialog boxes asking for permission to run the code that is linked. However, it is not necessary to send Word documents, so researchers have shown . Researcher Kevin Beaumont found a way to use the DDE feature in Microsoft Outlook via e-mail. In this case, users get the same notification as with Word asking for permission to execute code.

In addition to a RTF-generated email, the attack can also be performed via a calendar invitation. According to anti-virus company Sophos , the attack is easy to stop, users need to click on no-click in the first window asking for code execution. If the user clicked yes in the first window, a second dialog will appear for permission. Only when yes is clicked is the code called through DDE executed. Another option that users can apply to protect themselves is to display emails in plain text.

Fraudulent Android App Appears As A Word Document

Researchers regularly rogue Android apps by posing as porn app or Flash Player, but now there's also discovered a malicious app that will let the user into believing that it is a Microsoft Word document. For example, the icon of the app resembles that of Word.

The file allows users think that matters 'data'. If the file is opened, the app asks for administrator privileges. After installation, the malware seeks to SMS messages and other information like IMEI number, SIM card number, device ID, contact information and other matters and sends it to the attacker. The malware can also send text messages and dial phone numbers specified by the attacker. The app is aimed at Chinese users and is distributed outside of Google Play.

According to security firm Zscaler, discovered that the app is not surprising that PC-based malware techniques appear in the mobile domain, since mobile devices are now ubiquitous. For Windows, there is still active malware via common icons and file names occurs as a document and try to entice users to open.

US Warns Of Malware That Steals Money From Bills

Internet users should beware of a malware family that can steal money from bank accounts and computers can use for DDoS attacks, so let's Computer Emergency Readiness Team of the US Government (US-CERT), the Ministry of Justice and the FBI in a warning know.

Although Dridex-malware for more than one year exists, the government decided today to internet users for this threat warning. To infect computers with Dridex are mainly used e-mail attachments with Word documents. The e-mails look legitimate, and try to let the user open the attachment. In reality, the Word document containing a malicious macro. Once the macro is activated Dridex which will install on the system.

Macros are disabled by default in Word and users must also enable it manually. In spite of this extra step Dridex is successful. In case of a successful infection, the authorities recommend using a virus, change passwords and apply special remove programs. It is also advised to keep windows and installed applications up-to-date.

Tip: Adobe Reader Lets You Open Any Embedded Files

In recent weeks, cyber criminals several times PDF files sent which was hiding a malicious Word document. Once users opened the PDF file they were asked if they wanted to open the embedded Word document.

The Word document contains another macro that installed malware on the computer. The macro is executed only if users set it, but in practice this is an effective method of attack. Users and administrators can easily avoid, however, Adobe Reader opens these embedded documents, says Didier Stevens, handler at the Internet Storm Center. Through the Trust Manager, available via the settings of the PDF reader option can be switched off, as Stevens Also in this video shows.

Macro-Malware Steals Thousands Of Documents From Companies

From late February to mid-March, assailants carried out a campaign macro malware was used to steal passwords and documents thousands of businesses. The attack began with an e-mail contained a Word document. In the document were hidden macros that, when activated by the receiver, malware installed.

Via this malware were then the credentials of workers and business documents stolen. According to anti-virus firm Kaspersky Lab , the attackers managed to steal a total of 10,000 documents of companies, mainly from Thailand and India, although Belgian companies were targeted. In addition, also found thousands of stolen credentials, coming from hundreds of infected computers. By looking at the stolen credentials, according to the virus fighter very clear that workers malware statements sent to each other, since the host names and internal applications were the same.

E-mail Resumes And Internship Requests Infects Tills

Researchers have discovered a new variant of checkout malware that spreads via e-mail. The emails focus on companies and have different topics ranging from training requests and resumes, to ask if there are job vacancies. Attached is added to the e-mail a Word document. This document states that it is a secure document and the user macros must turn to see the content.

Once macros are enabled, the document will download the malware. This malware additional malware can be downloaded and installed. Through the malware that is first the attackers can determine what malware is then to be actively installed. It is then possible to install malware that targets POS systems that run on Windows. Several retail chains, especially in the US, using payment terminals that are connected to a Windows computer.

Once the computer is infected, the malware can intercept the data of credit cards and collect processed through the POS system. With the stolen payment card data can then be fraudulent. According to security firm FireEye shows that even attack cyber criminals engaged in random spam operations include cash and malware that can be used to infect some of their victims.

Malicious Word Document Hidden In A PDF File

Frequently happens that attackers use DOC and PDF files to infect internet users with malware, but recently a researcher found a PDF file called "Sales Invoice" that contained a malicious Word document.When opening the PDF file is via Javascript tried to open an embedded Word document. Standard warns Adobe Reader to open these embedded files.

If users ignore the warning and still choose to open the DOC file in Microsoft Word, then get them whether they want to run the macro in the document. In recent months, regular Word documents with macros used , which once carried download malware. Also in this case, it is after the execution of the macro malware downloaded. It is a variant of the Dridex banking Trojan, a Trojan horse that steals money from online bank accounts.

According to researcher Steve Basford the malicious Office documents at the time only against Windows users. "Apple and Android software to open these attachments and might even run the macros embedded in the annex," he tells his own blog.Belgian researcher and ISC handler Didier Stevens made ​​this demonstration video in which he analyzes the PDF file.