Our new @OutflankNL blog post on abusing the SYLK file format. This 1980s file type can host macros in modern versions of MS Office / Excel without hitting protected mode. Post includes recommendations for mitigation (note: active abuse in the wild).https://outflank.nl/blog/2019/10/30/abusing-the-sylk-file-format/ …
-
-
Don't forget that Microsoft Office installs URI handlers. https://docs.microsoft.com/en-us/office/client-developer/office-uri-schemes … Viewing a web page can open a XLM-containing SYLK. Depending on your macOS version and Browser, the amount of prompting you receive may vary. For example, Firefox allows you to disable the warning.pic.twitter.com/FhNzqNuEhy
-
For example, if you're unfortunate enough to still be using macOS Sierra (10.12.x), Safari will launch Excel to open an arbitrary file with zero user interaction. This makes for a complete drive-by download situation.pic.twitter.com/7tzrZ9U101
- 1 more reply
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.