Microsoft Macros: The sneaky threat looming in files

Malicious Micrsoft Macros

Microsoft macros: a blessing and a curse. Macros constantly have IT teams grappling between productivity and security. On the one hand, macros eliminate a great deal of monotony for end users by automating repetitive tasks. But, it’s also fairly easy for cybercriminals to embed malware within a macro that can evade security detections.

The solution to this problem isn’t black and white. It falls into a murky, gray area. In today’s workforce, macros are a necessity. And, in today’s threat landscape, robust security has become a necessity. As much as companies may want, they cannot block macros--it would cause serious productivity loss--or ignore security.

Understanding what exactly Microsoft macros are, the advantages they offer and the threats targeting them has become important as IT teams finally work to find the balance between productivity and security.

Macros defined

Macros are centered around automation, reducing the number of monotonous work end users perform and accelerating business productivity. Essentially, a Microsoft user can bundle a set of task functions into one single command that occurs automatically. We can thank macros for allowing us to sort Excel worksheets alphabetically or numerically. Macros are also to thank for the ability to merge or unmerge a group of cells in worksheets. Same goes for transforming data within a cell into a new format. These are just a few examples of macro-enabled tasks that end users perform daily. Many professions, especially the financial services industries, rely heavily on Microsoft (specifically Excel), which makes macros a game changer. If macros automate 10 to 15 tasks in Excel, organizations can save hours, if not a full day's work.

Macros and bad actors: a perfect match

Bad actors long ago figured out that they could hide malicious code within Office macros and have a high success rate of triggering the payload. Microsoft documents--whether Excel, PowerPoint, Word or others--are some of the most common file types used in attacks as they are the most widely used among organizations. Macro-based viruses have been around for decades with the first macro virus, dubbed Concept, appearing in July 1995 targeting Microsoft Word. Macro viruses targeting Excel appeared not long after. There are two main reasons this problem still persists almost 30 years later:

  • Relying too much on detection methodology: As a community, we have put too much emphasis on detection-based principles, meaning many of our security strategies are structured on searching for known malware signatures or known threats. Sometimes this also includes placing the onus on the end user to spot malicious attempts via phishing awareness training and other threat education practices. But, there are so many unknowns and advanced threats that detection-based strategies are inherently flawed. It’s extremely easy for a bad actor to create an unknown, zero-day threat. All it takes is a slightly modified piece of known malicious code and then it’s a zero-day not on malware signature databases that can bypass antivirus or sandboxing technologies. Malicious code also often gets embedded so deep within the macro and file contents that it’s unscannable by detection technologies. Detection does not equal prevention, and in some cases, once security teams detect the threat it’s already too late.
  • Advanced social engineering: Bad actors disguise the content containing the malicious code as innocent. Even the most security-conscious individuals are fooled. Attackers can spoof send-from email addresses/servers to appear as if they are coming from a trusted source--a coworker or legitimate company like FedEx. The bad actor will use jargon and language that the recipient would expect to receive from the anticipated source. This ties in to the idea that detection-based principles are not sufficient enough for today's threats. Phishing awareness training will reduce an organization’s risk but it cannot, and should not, be the primary source of protection. There’s typically always a degree of human error at the hands of socially engineered attacks. If these attacks are so socially engineered that they can fool and bypass security systems, imagine how many times they can fool end users and penetrate the network.

Knowledge is power

Macro-based threats are not new, but still plague organizations across the globe. Preventing macro- and other file-borne threats may appear like a small component of overall security strategies, but it can have the biggest impact. Microsoft Office has billions of users worldwide, resulting in an extremely large attack surface ripe with possibilities for opportunistic hackers. It doesn’t take an advanced, nation-state group to conduct these attacks, amateur hackers exploit macros all of the time.

When it comes to preventing macro-based threats, leverage knowledge as the best weapon. Understanding what macros truly are and how bad actors are exploiting them will shine a light on the weak spots in security strategies and allow us to turn that knowledge into action. Here are the questions security teams should ask when building out a file security strategy and seeking a solution provider:

  • How does the organization identify and neutralize unidentified file objects? Does that include malicious macros?
  • How does the organization prevent threats? How does it search for known bad or known good?
  • Is file fidelity and usability affected? How will it impact productivity as a result?

I often find that the answers to these questions are quite telling and serve as a great guide for security pros to better understand the reality of their overall programs and where they can improve that will benefit not only security, but the company as a whole.

Aviv Grafi, founder and CTO, Votiro

Aviv Grafi

Aviv Grafi is Founder & CTO of Votiro, an award-winning cybersecurity company that helps organizations accept safe content and data inbound, at scale, through Votiro’s open, API-based content disarm and reconstruction-as-a-service technology. Aviv is the principal software architect for Votiro’s enterprise solution, Votiro Cloud, which protects against known and unknown malware and ransomware in data, regardless of data source or destination.

Prior to co-founding Votiro, Aviv served in an elite intelligence unit of the IDF, nurturing his passion for finding simple solutions to complex security issues. Aviv’s areas of expertise span the cyber product lifecycle—from strategy and development, through go-to market—along with network security, IDS/IPS/firewall internals, defensive programming, enterprise security penetration testing, vulnerability research, and virtualization.

Aviv speaks publicly on these topics as they are relevant in order to raise industry awareness and push for innovative solutions. Aviv holds a B.Sc. in computer science, a B.A. in economics, and an M.B.A. from Tel Aviv University. He is the inventor and principal software architect of Votiro’s enterprise protection solutions.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.