D2T1 - Sandbox Evasion Using VBA Referencing
summary
Attackers host a remote VBA project and a tracking image, craft an Excel file that references the remote project, and use the request order — image-before-code vs code-before-image — to tell a sandbox from a real user; sandboxes request the VBA first, users fetch the image first. The server returns a benign VBA stub to sandboxes and a malicious VBA payload to users. Demo works against seven commercial/open-source sandboxes. Mitigations: block/inspect SMB and Office internet access, or sanitize files.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:18ABSTRACT
- 2:45RELEVANT BACKGROUND
- 4:08SANDBOX EVASION TECHNIQUES
- 9:09WHAT IS VBA REFERENCING?
- 11:16VBA REFERENCES
- 12:59VBA REFERENCING TRIALS
- 13:59VBA REFERENCING DEMO
- 16:13SANDBOX AS A BOTTLENECK
- 18:21STACKING IT UP
- 19:54WHAT IS EXTERNAL CONTENT AND WHY ARE WEB BEACONS A POTENTIAL THEREAT?
- 23:03SERVER-SIDE SANDBOX DETECTION
- 26:00WEAPONIZING
- 26:36SANDBOX FLOW
- 27:40USER FLOW
- 32:11DEMO?
- 34:56MITIGATIONS
- 37:19SUMMARY
- 39:18QUESTIONS?
related talks
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
51mAdvanced VBA Macros Attack & Defence
51mOffice in Wonderland
40mDigging for IE11 Sandbox Escapes Part 2
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
52mFlying Under the Radar - New Security Evasion Techniques
48m"Sneaking Past Device Guard"
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32