Hello, welcome to the Tuesday, May 31st, 2021, 2022 edition of the Sands and the Storms oners Stormcast. My name is Johannes Ulrich.

And I'm recording from Jacksonville, Florida. Due to Memorial Day here in the United States, we didn't have a podcast on Monday, but I'm recording this a little bit earlier as we do have

some breaking news that I think is worth putting out there a bit earlier than I would

usually record a podcast. So this breaking news is the MSMSDT vulnerability, often described as zero day, but essentially what

it comes down to is a novel way to execute code on a user system as a Microsoft Office

document is opened without triggering any prompts or additional user confirmation.

This was actually first spotted back in April and privately reported to Microsoft.

Microsoft didn't consider this vulnerability.

In part, it looks like whoever processed the report at Microsoft didn't completely

understand the implication of this vulnerability. Now, on Friday, it was sort of discovered

again after a sample that exploited the vulnerability was uploaded to Virus Total, and a Japanese researcher spotted

this technique being used. This Japanese researcher now underscore Sec is the Twitter handle

they're going by, did recognize that this is actually a pretty ingenious way to bypass many of the protections

that Microsoft has put in place in order to prevent things like macros and such from executing

without user permissions. So how does this work? Well, it starts out with an office document.

Now, it couldn't be any office documents.

So Excel, VERT.

VIRT seems to be the most commonly discussed at this point, but it's not limited to VIRT.

May even work in Outlook, for example, without the user actually opening any attachments or clicking on any links, but just by looking at an outlook message.

Now, Microsoft Office has a feature where we can specify externally hosted HTML templates.

So that's the first feature that's being abused here.

The document is being opened or viewed, and the HTML template document is downloaded.

...