Malicious Office Files

Did you know that a Word document can edit the registry, delete System32, and send emails on your behalf? Well, now you know!
Links:
en.wikipedia.org/wiki/Melissa...)
www.zdnet.com/home-and-office...
money.cnn.com/1999/03/29/tech...
www.cnn.com/TECH/computing/990...
Music:
Hypnospace Outlaw - Relaxation
Super Mario 3D World - World 8
Paper Mario Sticker Star - Jungly Jungle
Mario and Luigi: Bowser's Inside Story - SHOWTIME
Action 52 - Cheetahmen
Super Mario Land - Athletic Theme
Hypnospace Outlaw - SquisherZ

[@Truttle1]

discord: discord.com/invite/EKPBjjUc65

[@Cliffordlonghead]

First

[@Cliffordlonghead]

Awesome video

[@literallydoing4425]

Just wondering here, what animation software do you use? It seems like it'd be a good fit for me to start working with.

[@void_vale]

I always forget that Windows hides file extensions by default. That's such a terrible idea, I can't fathom how you would ever justify that, let alone come up with it...

[@IceMetalPunk]

They probably use the Apple excuse of "our customers aren't always technical, this might confuse them".

[@eternia15]

I agree, it has frustrated me for decades at this point. Who would consider this secure.

[@matthewrease2376]

One of Windows' many, many issues.

Obviously the best solution would be to ask for confirmation before changes to the file system, registry, mail sending etc. instead of the annoying and obstructive “You shall not open files from the internet. WE protected your device (because we, MS, control your PC, not you)”.

[@ETXAlienRobot201]

even better would've been not giving macros the level of access they have. if they're for automating certain tasks in documents, who do they need full filesystem access, access to the registry, ability to tweak the settings of word, etc... ?

[@275hammy]

​@@ETXAlienRobot201 So people using it for legitimate purposes can do powerful things. Can't think of many good ones, but one could use macros to set up a word document with a letter format that is addressed to the person who sent the most recent email, look at a local database file to populate an Excel spreadsheet, etc. Not saying this as my position on the matter, just saying why it was likely made so powerful

[@leonidas14775]

They should make macros a feature that the user opts-in to installing. Most people will never use it anyway.

[@BringMayFlowers]

@@leonidas14775 As far as I remember (it's been years since I used Microsoft Office), it is, people just install it for either compatibility (unfortunately, in 80% of cases that compatibility is just with malware) or if they think they *might* need it one day just so they don't have to get the CD out again.

[@unicodefox]

The problem is, users don't read message boxes. The text in a message box or a warning dialogue does not exist to a regular user. Even if you write "DO NOT THIS DO THIS IT IS VERY DESTRUCTIVE" in 72pt flashing text, users *will* ignore it. You cannot make dangerous operations a single dialog box click away because users just want to open this document, and don't care for anything getting in their way. If your response to that is "if they click the button to break their PC it's their fault", you don't understand the point. Microsoft does not make software for consumers. Microsoft makes software for businesses that consumers can buy. And, businesses will *never* buy software that lets a careless user send all their company secrets just by clicking a checkbox, no matter how much you hide it.

[@FinnPlanetballs]

oh boy! it's august 4th, and i hope my word document hasn't been infected!

[@Truttle1]

uhm ackshually it’s April 24

[@cmyk8964]

Fun fact: Etymologically, “ain’t” comes from “am not”!

[@cassandradawn780]

that is indeed what it meant before the early 19th century, then it started being used as a contraction for "is not", "are not" and others. (just adding onto your comment; etymology is weird)

[@carsoncoder]

Then why don't we use amn't

[@notwithouttext]

and "aren't i" also comes from "am not"! "amn't" is hard to say, so it was simplified to "an't". and in the south of england, there was a sound change which lengthened a bunch of a's, like in bath, glass, example. it made "an't" and "aunt" no longer sound like "ant", and more like "ahnt". in that same part of england, r's had been dropped, so "an't" sounded exactly like "aren't", and it had a similar meaning. thus "an't i" became "aren't i", and it spread to american english as well.

[@algotkristoffersson15]

Where does the I come from then?

[@notwithouttext]

@@algotkristoffersson15 the "a" sound changes in some accents in some positions before m, n, and g. so can't turns into cain't, but can isn't cain. similarly an't becomes ain't.

[@womagrid]

The animation style seems to imply an inaudible reggae soundtrack.

[@Vallee152]

I had a job specifically for writing macros in Excel documents They used the excel documents as databases

[@rigen97]

happens much too often I think it's because excel is easier to learn and easier to print from for "office" people honestly it probably beats Access in small business

[@IceMetalPunk]

At my company, we're currently in the process of setting up our internal databases for the second time (long story). But this time, we're doing it right; because currently, half our information is stored in various and sundry Google Sheets, often populated from Google Forms, and nowhere else 😑 I'm the one who advocated hard to fix that...

[@Vallee152]

@@rigen97 they do have a proper database that they pay an enterprise subscription to, forget what it's called, but it's missing some features they would like, so they export any active work orders, claims, etc. as CSV's and put them into XLM's

[@garbageyoutubechannel310]

why r they moving around so much

[@JimWolfie]

Bowser has big obfuscation energy. I approve

[@lonec1777]

The reason variable names in a lot of malware is confusing is because they want it to be difficult to decipher what the malicious code is doing. This is especially true whenever the symbols or code is in someway viewable.

[@henke37]

You know the fun part of macros? You can load arbitrary dlls and call functions in them. So even if they didn't include all the destructive features by default, you could just add them to VBA yourself.

[@official-obama]

as foretold in the prophecy

[@Truttle1]

zomg official obama???

[@official-obama]

@@Truttle1 yeah i need to become president again can you give me your credit card information

[@Truttle1]

@@official-obama my old number ended in 666 so if you find my lost card in houston that i cancelled three months ago and it ends in 666 it's probably mine.

[@thiesenf]

The famous "I Love You" malware was written in WBA...

[@MrLetsGamePlayHD]

It was written in vbs (VBScript) which already comes with windows.

[@EdKolis]

Even VBscript is going to be deprecated soon. Wonder what will happen to all the classic ASP web apps?

[@matthewrease2376]

2:30 this is the most praise Visual Basic has ever gotten or will get 😂😂

[@Alex1891]

As one of the comments ever written, I would like to say that I found it cool and cohesive when you made the point of showing file extensions by showing us the project folder for this video!

[@1leon000]

kilroy was here

[@Golem642]

I remember when i was younger i used to make very simple batch viruses that spams terminal consoles Nostalgia kicking hard

[@Truttle1]

When I was in AP CS in high school, I made a Java program that moved the mouse to the Start Menu and shut your PC down. It was really fun sending that to students in the class and not telling them what it did. It was even more fun synchronizing all the PCs in the classroom to shut down by having it start at a specific time and play music as it did so :P

[@Cliffordlonghead]

​@Thiruttle1

[@IceMetalPunk]

In college, I first learned about fork bombs and was like, "that doesn't seem so hard". So I hid a sort of fork bomb in a "game" that added itself to Startup with a flag that would cause the "game" to just keep forking itself exponentially. I released it onto a game dev forum as "a WIP game that I'd like feedback on", from a burner account, and then was amused at my own smugness. A few months later, I forgot what it was and opened it on my machine... ...fun times when you're a cocky little piece of shit who thinks breaking things is fun, and then karma bites you 😂

[@rockpie]

10 cmd 20 goto 10

[@maker0824]

That’s some idle animations

[@kornsuwin]

adobe ads try not to have the worst compressed music ever challenge

[@ghasttastic1912]

9:05 hypnospace fan detected.

[@unicodefox]

also, microsoft ported the vba editor to macOS because of course they did. it looks as out of place as you'd expect

[@the-pink-hacker]

I love the framing device you chose for this video. Great hidden gem!

[@mrdoognoog]

squisherz theme for the outro, that's really cool™️

[@i_teleported_bread7404]

0:06 Is this the first time we actually learn Eidex's full name? I don't recall it being mentioned in any previous videos.

[@Truttle1]

It was in earlier videos such as the Whenever one (I think) but this was the first time I gave him a middle name. Eidex Firben Lagarto is actually a joke name, see if you can find what the joke is :P

[@Bautista_Fam._y_Co.]

6:06 That ain't a virus, i'ts a worm!

[@jacobusburger]

“Bro wake up, new Truttle1 video dropped!”

[@angelcaru]

I would know, I started programming on VBA :)

[@nnnArchive]

ay how ya doin’? you been feelin’ any different since the redesign? also do you have any plans to bring back cosmos quest?

[@gydo1942]

ah yes, office macros. I once used it to gain access to my teacher's computer using a metasploit reverse payload. (with permission!) Good times.

[@matthewrease2376]

9:28 office also exists online is and free. It's also more accessible for those with disabilities. And it's not Google so there's that.

[@rigen97]

kinda surprised this didn't touch on popular ransomware

[@Aredsus]

i found a programming language ya didnt make a video on it: among us

[@enthusiasticgeek7237]

hypnospace music???

[@matthewrease2376]

Writes simpson joke Gets 20 months in prison Bruh.

[@Truttle1]

I think it was the crashing email servers via exponential spam part that got him in prison though

[@matthewrease2376]

@@Truttle1 just a skill issue, it got them to upgrade their servers 😂😂

[@user-iy6dt4xp5o]

This is your 2^7th video

[@unchaynd7266]

Have you tried using Linux

[@Truttle1]

I use Linux quite often actually.

[@Exvixcity]

You sound alot like Jan Misali

[@Cliffordlonghead]

Hi

[@Truttle1]

Hi!

[@Stiky_Piston]

YAY! ANOTHER 1eltturT vid!

[@thescratchguy428]

BAHAHAHA

[@randomazzy11]

OMG HI TRUTTLE1

[@Truttle1]

OMG HI RANDOMAZZY11

[@TopchetoEU]

500 vieews in 2 hours??? criminal

[@thescratchguy428]

lol hhee

[@YEWCHENGYINMoe]

17h ago

[@JoaoCarlos-df1zw]

First!

[@1leon000]

i was here before this video was 5 minutes old

[@Cliffordlonghead]

NOT

[@nnnArchive]

BOo

[@JoaoCarlos-df1zw]

Let my old KZbin things alone !!!!