Microsoft to Block Excel Add-ins to Cease Workplace Exploits

Microsoft plans so as to add a function to Workplace Excel that may make it more durable for cyberattackers to use the spreadsheet utility’s “add-ins” perform to run malicious code on a sufferer’s pc.

And whereas it is a welcome growth, Microsoft’s countermeasure is simply the most recent go-around within the cat-and-mouse sport happening between main software program makers and cyberattackers, researchers say.

Microsoft Takes Goal at XLLs 

In an replace to its Microsoft 365 highway map final week, the corporate acknowledged that it’s presently “implementing measures to dam XLL [add-in files] coming from the web,” with a objective to have the function generally availability someday in March. 

Excel add-in recordsdata are designated with the XLL file extension. They supply a method to make use of third-party instruments and features in Microsoft Excel that are not natively a part of the software program; they’re much like dynamic hyperlink libraries (DLLs) however with particular options for Excel spreadsheets. For cyberattackers, they provide a method to learn and write knowledge inside spreadsheets, add customized features, and work together with Excel objects throughout platforms, Vanja Svajcer, a researcher with Cisco’s Talos group, stated in a December evaluation.

And certainly, attackers began experimenting with XLLs in 2017, with extra widespread utilization coming after the approach grew to become a part of frequent malware frameworks, similar to Dridex. The add-in performance has grow to be more and more standard with attackers since then; in reality, in response to an Arctic Wolf report from early 2022, the usage of XLL recordsdata elevated practically 600% in 2021.

One of many causes for that’s as a result of Microsoft Workplace doesn’t block the function however raises a dialogue field as an alternative, a standard method that Microsoft has taken prior to now, Svajcer wrote: “Earlier than an XLL file is loaded, Excel shows a warning about the potential for malicious code being included. Sadly, this safety approach is commonly ineffective as a safety towards the malicious code, as many customers are inclined to disregard the warning.”

That might be a difficulty even after blocking is in place, Mike Parkin, senior technical engineer at Vulcan Cyber, tells Darkish Studying.

“Sadly, it is unclear at this level whether or not it is simply going to be a warning that customers can simply click on by way of, a extra proactive ‘off by default’ setting, or whether or not they’ll disable it completely for XLL recordsdata downloaded from the Web,” he notes.

Staying Forward of the Cyberattackers?

For greater than twenty years, cybersecurity corporations have sought to strip out potential avenues for malicious scripts in frequent recordsdata sorts — similar to Workplace codecs or PDF recordsdata — however attackers have all the time tailored. 

For example, Visible Fundamental for Functions (VBA) and Excel 4.0 macros each grew to become so standard over the previous 5 years for malware supply that Microsoft blocked Workplace macros by default in the summertime of 2022, disallowing macros from working once they have been assigned a Mark of the Internet (MotW) tag, which signifies that the doc got here from the Web.

Following that call, risk actors started incorporating Shell Hyperlink (LNK) recordsdata as payloads for a lot of malware households, with their use peaking in October with a spike in utilization by the operators behind Qakbot, in response to an evaluation this week by researchers in Cisco’s Talos intelligence group.

And LNK recordsdata aren’t the one file kind that is turning into a extra standard method to conceal malicious code within the wake of blocking macros. Within the third quarter of 2022, for instance, zip archives and HTML recordsdata grew to become the commonest file sorts for malware supply, with 44% of malware recordsdata hidden in archives, in response to the third quarter “HP Wolf Safety Menace Insights Report.” 

Even when these different approaches usually are not as environment friendly or highly effective, attackers must undertake them to proceed to efficiently compromise sufferer’s methods, as a result of firms are hardening their merchandise towards extra frequent assault strategies, Dave Storie, an adversarial collaboration engineer at cybersecurity-services agency Lares Consulting, stated in a press release despatched to Darkish Studying.

“When organizations like Microsoft cut back the assault floor or in any other case enhance the hassle required to execute an assault on their product choices, it forces risk actors to discover alternate avenues,” he stated. “This typically results in exploring beforehand identified, maybe much less very best, choices for risk actors to attain their goals.”