The Office Demon: Minos

Abstract

Office documents (Microsoft Office and LibreOffice) has become a standard for transmitting information. They are used daily by many users. It should however be remembered that this type of documents are much more than inert files. They may contain an executable part who is called macro. Macros are present since the creation of these Office suites to automate some actions. It is possible to divert the initial use of macros to make it a true infection vector of systems. Since 2007 and the case of the attack on the German chancellery, the number of attacks via this type of documents continues to grow. The ability to access high-level programming languages and interact with the target system, greatly increases the risk of attacks. Changing the security of these Office suites is easy, leaving the door open for malicious attacks without the user noticing. In this paper, we present one tool that is a proof of concept. It is intended for the prevention of the user. It aims to give demonstrations of risks associated with Office documents. It is able to change the security of Office suites and infect documents directly with a macro. It also includes a USB mode of infection, to retrieve all documents from a USB stick and then infect all Office documents. It is possible with Minos, to control and modify the security of versions 2003, 2007 and 2010 of Microsoft Office and versions 3.4 and 3.5 of LibreOffice. Similarly it is possible to infect documents Word, Excel, Powerpoint of Microsoft Office and their counterparts in LibreOffice. If a file already contains macros, you can either delete the macro and replace it by your macro or include your macro next to the other macros. The data presented in this report are technical and operational. We have worked in environments with restricted rights showing that it is possible to make powerful attacks by infecting Office documents.