Sensepost posted 10 days ago about a vulnerability which can trigger command execution, without use of macros, when someone opens a specially crafted Office document. Although a little bit of social-engineering needs to come in play for the victim to click ‘yes’ to the first 2 of 3 message boxes, most end-users are easily tricked. They found that by abusing the parameters of the DDEAUTO function that they could use powershell to download malicious payloads remotely. DDE is a legacy Inter-Process Communication (IPC) mechanism dating back to 1987, which establishes a dynamic data exchange (DDE) link with a document created in another Microsoft Windows-based program, (new information becomes available in a linked document, a DDE field inserts new information when you update the field). SensePost discovered that instead of specifying an application like Excel, an attacker can specify arbitrary parameters of another application as the first parameter, and quoted arguments as the second parameter (which cannot exceed 255 bytes). Continue reading
Contact Me
Social Media
Categories
-
Recent Posts
RSS Blogroll
- Linux, OpenSSF Champion Plan to Improve Open Source Security
- Log4Shell Exploit Threatens Enterprise Data Lakes, AI Poisoning
- Data Transformation: 3 Sessions to Attend at RSA 2022
- How to Avoid Falling Victim to PayOrGrief's Next Rebrand
- Threat Actors Use Telegram to Spread ‘Eternity’ Malware-as-a-Service
- Malware Builder Leverages Discord Webhooks
- You Can’t Eliminate Cyberattacks, So Focus on Reducing the Blast Radius
- Novel ‘Nerbian’ Trojan Uses Advanced Anti-Detection Tricks
- Moving to gitlab
- Swag
Archives
- April 2021
- January 2021
- July 2019
- May 2019
- September 2018
- June 2018
- October 2017
- September 2017
- June 2017
- May 2017
- April 2017
- December 2016
- November 2016
- October 2016
- July 2016
- May 2016
- April 2016
- March 2016
- January 2016
- October 2015
- July 2015
- May 2015
- March 2015
- February 2015
- January 2015
- November 2014
- October 2014
- September 2014
- June 2014
- March 2014
- February 2014
- September 2013
- June 2013
- April 2013
- January 2013
- March 2012
- February 2010
- September 2009