This hypothetical scenario shows how easy it could be for an attacker to establish the pretext for gaining entry into a corporate network using a Word macro virus. It is a powerful display of why social engineering can be so effective.
Macro Virus Definition
A macro virus is a type of computer virus spread using a macro language, which is a type of programming language for automating user actions within a larger application. Software such as Excel and Word allow people to store macro programs within documents that execute when the document opens or when a button is clicked.
Creating a macro is very easy, which is good news both for legitimate users and hackers. The macro language in Microsoft software is Visual Basic for Applications (VBA). It is quite a primitive language as far as programming languages go.
Legitimate users often create macros to automate sequences of actions in one click. For example, a popular Word macro can automatically insert a company’s letterhead into a document; a process that normally takes a few minutes.
However, because VBA is capable of importing outside libraries, it has a long history of being used for nefarious reasons. In fact, you can call the entire Windows API using VBA code. Because of this API-calling capability, running a macro-enabled document is essentially the same as running a standard portable executable file in Windows.
Example Macro
What our example Word macro virus actually does is not significant in this article. It could be code that when executed, establishes the initial compromise as part of an advanced persistent threat. I’m not concerned about technical code details: the most important part of getting a malicious macro to run is actually getting the targeted user to actually run the macro. All the code obfuscation skills in the world mean nothing when the target isn’t convinced to do what you want them to do.
As part of its security defenses against macro malware, Microsoft now disables macros from automatically executing by default. The challenge, therefore, for the modern hacker is to establish a suitable pretext that will convince a targeted human user to run the macro. In other words, it’s a social engineering problem.
Getting someone to open a macro is far less of a problem than you might think. According to Verizon’s 2019 Data Breach Investigations Report, one-third of all breaches involved social engineering.
Consider the following hypothetical scenario: a hacker wants to obtain proprietary data from a pharmaceutical company.
The hacker decides to create a Word macro that downloads or otherwise establishes a secondary payload upon execution, giving them unfettered access to the internal network of the company.
The person carrying out the attack looks up the targeted company’s employees on LinkedIn for people with common names. He finds the validation engineer, a suitable target who likely has access to valuable information about processes or the efficacy of products. Let’s call the validation engineer Mr. Dave Rogan. The attacker also looks for an employee in HR with a similar name and finds someone named David.
The emails of these employees can usually be obtained with relative ease, using a tool or by simply checking the LinkedIn profiles.
A simple trick often deployed by cybercriminals to get people to run macros is to craft an email that has been apparently sent to the target by mistake. Within the email is an attachment that contains information the target will benefit from seeing. The attacker knows that despite the natural inclination to not run unverified macros, the emotional pull of seeing certain information is often overwhelming and goes against this inclination.
In this hypothetical scenario, the hacker uses the current economic downfall and a spate of upcoming redundancies to get our validation engineer to open the Word document run the macro. The email may look as follows:
For our validation engineer, Dave Rogan, this email is incredibly compelling. He has just received an email that he wasn’t supposed to get, outlining upcoming redundancies in his own department! The emotional pull to take a peek and see if his name is in the document is too strong.
Furthermore, because Dave is seeing a document that he wasn’t meant to see, he probably isn’t going to say anything to the IT department.
The hacker can add a macro button to the file that executes the malicious VBA code when the target clicks the button. The button would say something like “Enter Password”. The document would be blacked out, and our victim Dave thinks that entering the password and clicking the button will reveal the confidential redundancies list.
The button wouldn’t actually do anything for the user, though, even if the password entered is the same as was indicated in the original email. To further deter the target from reporting this document to the company’s IT department, a prudent attacker can easily insert a false popup message box warning them that further incorrect password attempts will be reported to IT.
Closing Thoughts
Spreading a Word macro virus is as simple and as deadly as that. Using a combination of technical hacking skills (which I haven’t dealt with here) and social engineering techniques, the above Word macro virus example should serve as a striking insight into the efficacy of attacks that exploit human psychology.
Target organizations need to be aware that this type of psychological manipulation is very regularly used by malicious intruders to gain access to valuable data or otherwise disrupt their networks. Defending against this type of attack requires continuous employee training and awareness around social engineering.