Security researchers brought to life and released a wicked variant of Clippy, the recently resurfaced assistant in Microsoft Office that we all loved so much to hate, that makes it more difficult to detect a malicious macro in documents. Dubbed Evil Clippy, the tool modifies Office documents at file format level to spew out malicious versions that get by the static analysis of antivirus engines and even utilities for manual inspection of macro scripts. To do this, it takes advantage of undocumented features, unclear specifications, and deviations from intended implementations. Macros are snippets of VBA (Visual Basic for Applications) code that automate tasks in Microsoft Office applications. They are constantly used to deliver malware when the user opens a document. Researchers at Dutch security testing company Outflank developed Evil Clippy for professionals running red team attacks against a client organization. The tool runs on Windows, macOS, and Linux. The tool can be used with documents formats for Microsoft Office 97 - 2003 (.DOC and .XLS), and  2007 and above (.DOCM and .XLSM, which are basically ZIP containers and come with macros enabled). All these file types use the Compound File Binary Format (CFBF) and Outflank's program modifies it using the OpenMCDF library. One technique Evil Clippy uses to generate a maldoc is "VBA stomping," a method detailed by Walmart's security team, by which the original code of the VBA script can be replaced by a compiled version for the VBA engine called pseudo-code, or p-code in short. Infosec expert Vesselin Bontchev detailed publicly that VBA scripts can execute at runtime in three forms, with p-code being the most popular. We more posted on OUR FORUM.

Microsoft will begin to ship an in-house custom built Linux kernel starting with the Windows 10 Insider builds this summer. This kernel is to become the backbone for the new Windows Subsystem for Linux 2.0 or WSL2. Unlike WSL1, which used a Linux-compatible kernel, WSL2 will use a genuine open-source kernel compiled from the stable 4.19 version release of Linux at Kernel.org. While Microsoft will be providing the Linux kernel, they will not provide any Linux binaries to go with it. Instead, users will still need to download their favorite Linux distribution from the Microsoft Store or by creating a custom distribution package. While the source code for the kernel will come from Kernel.org, Microsoft has stated that they will apply custom patches that reduce the memory footprint of the kernel and provide hardware compatibility. In the first iteration of the Windows Subsystem for Linux (WSL1), Microsoft had to translate Linux system calls so they could communicate and work with the Windows NT kernel. With the use of a true Linux kernel, it is no longer necessary to use a translation layer and apps will have full access to their normal system calls. Removing the translation layer not only improves compatibility for Linux apps but also increase file system performance. According to tests performed by Microsoft, the new Linux kernel has improved the performance of WSL, with unpacking archives up to 20x faster and tools such as npm, git, and cmake being 2-5x faster. To make it easier to administer WSL2, Microsoft will also include the Linux kernel in Windows Update so that security updates and improvements will automatically be delivered to Windows 10. Learn more by visiting OUR FORUM.