In an earlier newsletter (March 2015), we talked about Macro viruses and that it was making a comeback. In it we stated that, “A macro virus is a computer virus that replaces a macro. A macro is basically a single instruction that expands automatically into a set of instructions to perform a particular task. In other words, a macro is a way to create a shortcut for a task that you do a lot. For example, the “open document” action in many word-processing programs relies on a macro to function. Macro viruses change this command set, allowing them to execute whenever the macro is run.”

Programs with the extension .EXE are not the kind that one should open. Legitimate software hardly ever gets distributed by email, so rest assured that those .EXE attachments are almost always malware: viruses, worms, Trojans, ransomware, spam zombies, etc.

As such many companies block all emails that contain .EXE files. It is good practice as it would reduce the chances of infection. Then again, emailed documents such as .DOC or .DOCX are received and opened very often. In fact in some jobs, the staff is expected to open such documents that are sent to them.

Recommendation

1. Don’t be tempted to reduce security (e.g. by enabling VBA macros) because a document tells you to do it. Malware may tell you that macros need to be enabled “for security purposes.” Such documents should be regarded as untrustworthy.

2. Consider blocking Office files emailed from outside if they contain macros. VBA macros used in your organization should ideally originate from IT, and not from un-trusted outside sources.

Definition

Downloader – an application that will download and install other Trojans / malware into your computer.

Source

1. Naked Security.

2. (Source of image)

The Week That Was

1.  GreenDispenser ATM steals cash from banks. ATM-infecting malware is becoming increasingly sophisticated in its attempt to help criminals to empty out cash machines. And the criminals don’t need to previously stolen credit cards from legitimate users to do this. The GreenDispenser allows thieves to extract large amounts of money from cash machines, while avoiding detection. In order for this to work, ATMs need to be infected by the GreenDispenser malware. The attacker needs to have unrestricted physical access to the device, or assistance from bank employees.