Showing posts with label #OfficeFile. Show all posts
Showing posts with label #OfficeFile. Show all posts

Friday, 12 January 2018

DDE Attack


In the recent weeks we are more and more often reading news that talks about attacks that exploit DDE technology, Botnets that exploit the DDE attack, Ransomware that are distributed via DDE attack and so on.
Well, this is the right time to clarify this technology and this new attack way.

Let's start from the basics, what is DDE?
DDE, which stands for Dynamic Data Exchange, it is an interprocess communication system (IPC) introduced for the first time in 1987 with Windows 2.0.
This technology and its functionality have been largely supplanted by OLE - Object Linking and Embedding. However, DDE is still used due to its simplicity.

Like macros, DDE is a legitimate feature of Microsoft Office and allows to share a set of data between applications. For example, you could create a Word document linked to an Excel document so that the data in the first one will be updated automatically whenever are you changing Excel spreadsheet data.

In which way this attack is bring out?
Performing a DDE attack is very simple. Just add the string {DDEAUTO} to call the DDE feature, , in the text of a Microsoft Word document, followed by the command you want to run, all within the braces.

Can it be used only in Office documents?
No, not only Microsoft Office documents.
This attack can also pull off via Outlook, by sending an email, an email or an appointment, known as "calendar" in company jargon.


Now we are going to create a formatted content using Microsoft Outlook's "Rich Text Format" (RTF) and insert the malicious code inside it and save it as email. Next step will be to attach this one to the email we'd like to send, write a a title and a text to attracting victim's attention and push it to open it.


What can you do with this attack?

In which DDE attack would be used:

  • to send a computer in Denial Of Service (DOS) by running countless instances of a specific software until the available resources are saturated;
  • running software or scripts that could give full control of the computer to the attacker;
  • download malware to use to exfiltrate data.


How to recognize fraudulent content?
When you are opening the file, a warning message is showed to you. It is warning yo that the file has an external contents and asks for confirmation to continue.


If your chiose has been "YES", a new message will be displayed asking if you want to run a specified application. The in example below the command / application quoted is "cmd.exe".


However, it should be noted that the information concerning the execution of the command can be hidden or omitted by editing the syntax of the malicious code.

How to defend yourself?
When the warning message realated external contents has popped out, clicking "No" block the attack attempted.


You can also defend yourself better by changind setting and display all messages in text format.
However, this workaround involves the deactivation of all formatting, colors and images from all incoming e-mails and consequently some contents could not be rendered.

Why this new attack?
Cyber criminals are starting to use DDE technology because it is different from macro and because they are always looking for new ways to mislead the victim.
For years we are witnessing attacks based on the macro but fortunately you can disable this technology and therefore prevent malicious content from being automatically performed when the file is opened.
This new way, though it has some limits dictated by the interaction with the user, could lead an untrained or careless person to think that it is an error that occurred due some file's errors.
In the last weeks this new attack way has grown exponentially thanks to the fact that you do not have to send attached to the email documents of Microsoft Office or PDF, but just attach another email or a "calendar".


Please note, this article was created in the end of October 2017, but only at this time I have been able to publish it.

Friday, 10 March 2017

New Way to run VBScript Payload


Some day ago I received an email in an unmarked Gmail mail box. It was a clear Phishing email, but what catched my eyes has been a Password reported into the email's body and the attachment. It was a Microsoft Word file with ".docx" extension.

The first question that I asked to myself was: "Why this file wasn't dropped from Google security check?".

I decided to analyze the attachment and investigate about the sender.

First of all, I opened the attachment and putted into the password reported into the email's body. Opened, it had only three icons that looks like word's icons.



My first words were "What a fuck of Word file is this?!?!".
It doesn't makes sense! No text, no request to enable macro on startup.

The total words catch my eye. As you can see into the red circle, they were 369 words, but the document didn't had text, only 3 image's icons.

Double click on the image and I discovered the secret. The macro, VBScript, is embedded within it!

"What?! A macro into an image?!...You are a fucking genius!!" I Thought.

 But in which way is possible to embedded a VBScript into an image?!

The answer of my question was behind the right-click. Who created this document used Packager Shell Object to embed the VBScript content.

Taking a close look to Packager Shell Object properties was easy to understand that it was a VBScript file and where it was it was stored.

It was stored in "\Local\Temp" folder every time the Word file is executed. When the file is going to shut down it is going to be deleted from this folder.



The VBScript was obfuscated, but not in a hard way.

In the snippet code reported below, is reported two different files that are going to be created based on seconds:

  • the first one had extension ".viv"
  • the second one had extension ".qde"
Please note, seconds were used as file's name.



"JAy0D" function reads from file ".qde" and write into the file ".viv".

The snippet code reported below shows the resource that the dropper has to download, file with extension ".pkg".



Using whois protocol, I retrieved domain's information. Is useful to note that this domain is protect by privacy policy agreement.



File format ".pkg" is an installation file used by Apple in its Operating System.

Was impossible to download "tmp.pkg" file. The server gave error 404 Not Found.


Another resource that has to be downloaded is a file ."jpt".
JPT format file (JPEG-PNG-Type) takes advantage of the compression ratio from JPEG and PNG at the same time.
The main image is stored in JPEG while the alpha channel is stored in a PNG file as a gray scale.
While the PNG file can be 32 bit, 24 bit, 8 bit or even palette based, it is recommended to use
only 8 bit or palette based images in order to save space and actually take advantage of the JPT
format.
The next step was to analyze this file.


There I discovered the home page where this library come from.

It was hosted in a github page that it is not longer available.


From the page, I was able to recovery the developer's name "Jake J. Davis" and thanks to Google Cache, part of his GitHub account.

Jakey J. Davis closed a lot of his accounts in the last months, like github, libraries.io, etc.

Another analysis I did was the email's header. Here we can read sender's PC name connected to the server.




 Hey! Bruce, remember: "The first Internet's rule is: Stay Stealth"! 👀


CONCLUSION and HESITATIONs:

Something doesn't seems clear.
  1. File PKG is not reachable.
  2. JTP file doesn't seems to be JTP's format.
  3. This VBScript works only on Windows OS and it acts as a dropper to download other resources. It also use windows like commands ("cmd.exe") to perform some checks ("ping 8.8.8.8");
  4. If everything seems wrote for Windows OS, why it has to download file that works on Mac OS?







In conclusion: Given all these inconsistencies, many questions are still outstanding and this leave us two options, everything is part of a bigger project or the one who created these files is a newbie?


Thanks to my colleague for the support provided! ☺