Windows XP File-Based Attacks

1
Windows XP File-Based Attacks

• Chris Dalbec Chris Woodard

2
Overview

• Why This Topic
• Background
• Macros
• Other Files
• Lab Contents

3
Motivation

• File-Based attacks are popular over email and
  peer to peer programs
• New unpatched exploits
• Unaddressed in previous labs

4
Macros

• Some of the most common windows programs allow
  for macros
• Macros are mini programs ran inside Microsoft
  office documents for efficiency
• Macros are can execute programs installed on
  windows

5
When Good Macros Go Bad

• One of the most popular internet attacks come
  from the downloading of macro enabled documents
• Why are they so potentially dangerous

6
Other Files

• Malformed Word Doc
• HTML Files
• Vector Markup Language
• MSHTML
• Windows Metafile

7
Section 1 - Macros

• This portion of the lab will focus on macro
  attack
• The student will
• follow the procedure to produce a virus
• Inspect and investigate the created virus
• Run the virus exploit
• Review and test safe measure to prevent the
  exploit

8
Short video of Exploit

• Walrus Virus Editor in action!

9
Section 2 - Other Attacks

• Students will learn how to defend against
• HTML based Attacks
• Malformed Word Documents
• WMF Attacks

10
References

• www.wikipedia.org
• www.milw0rm.com

11
Questions?