Spreading CSV Malware over Google Sheets

guest · Jan 31, 2019

Spreading CSV Malware over Google Sheets
January 30, 2019
https://marcoramilli.com/2019/01/30/spreading-csv-malware-over-google-sheets/

A .CSV file could be a malware carrier and if interpreted by Microsoft Excel it could become a malware executor ! When I personally saw this technique back in 2017 (please take a look to here, here and here ) I was fascinated.

But what if an attacker writes malicious contents into one or more cells ?
A series of empty fields preceding a final and fake formula piping a CMD.exe command is spawned. By using the bitsadmin technique the attacker downloads a file called now.exe and stores it into a temporary system folder for later execution.

While OpenOffice and LibreOffice patched this vulnerability in the following versions: OpenOffice-4.1.1 (ref here) and LibreOffice-4.3.1 (ref here), Microsoft decided to allow this behaviour by introducing two user “warnings”.
These warnings recommend that the user shouldn’t click if he does not trust the source of the file…. here we go !
Click to expand...

In 2019 the most interesting thing about this technique is the ability to bypass Google filters. By implementing .csv dropper technique an attacker could easily use Google Sheets as a Malware vector.

Finally an attacker could send a clear link over an instant message platform and/or over eMail asking to open up a Google Sheets suggesting to the victim to open the spreadsheet locally since “MSExcel compatibility issues”. At that time if the victim downloads the Google sheets and opens up locally (with Microsoft), the attacker might infect her box.
Click to expand...

Log in or Sign up

Spreading CSV Malware over Google Sheets

guest Guest

Log in or Sign up

Spreading CSV Malware over Google Sheets

guest Guest

Useful Searches