Slashdot Mirror
Microsoft Word Documents That "Phone Home"
ephraim writes "According to
The Privacy Foundation,
Microsoft Word documents have a 'feature' which allows the documents' creators to place web bugs within the documents that inform the author whenever somebody has opened the document via a web server's logging facilities. This 'feature' can also be used to set and view cookies on the reader's copy of Internet Explorer. The story can be found
here.
While this might be useful for tracking the distribution of confidential documents, it also raises serious red flags about privacy since most people probably aren't expecting their copy of MSWord to announce their reading habits every time they use it."
Props to their CTO
Richard M. Smith.
Here is what Microsoft had to say about it (emphasis added)...
Vendor Contact and Response
Microsoft was contacted about this issue on 8/4/00, and again on 8/25/00. They confirmed that Microsoft Word will access the Internet in order to fetch Web images that are linked to in a Word document. They went on to say that Word uses Internet Explorer to fetch images and therefore standard Web browser cookies can be both read and set from inside a Word document. However, the company claims that Word users can mitigate the use of cookies.
Regarding the potential use of Web bugs to track Word documents, Microsoft said that there is no evidence that such activities are occurring.
If I distributed an HTML document which had references to images or other objects on some website, every user opening that HTML document would cause an access to that web site.
Mmmm.. Donuts
Since it's not happening now, it couldn't possibly start happening later. I've never seen a problem with a MicroSoft product be exploited weeks, months, even years after it was released. Now I'll be able to sleep at night.
--Ty
So let me get this straight. Word can:
-Run arbitrary macros
-Access your hardware
-Access the Internet
-Download and upload data
-Set and send cookies
I'm beginning to think Microsoft is right: They don't know the difference between an app and an OS.
Just to spell it all out: A Word macro virus now has the ability to, say, infect all your existing Word files such that when you open one of those files the contents are sent to a named address on the Internet. Goodbye confidential documents!
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
We shouldn't be too surprised; Web Pages are already like this.
I remember the surprise that a friend of mine showed when I showed her "Apache Logs".
Her first reply was, "HOW CAN I MAKE IT NOT DO THAT?!?"
(This is a particularly paranoid friend of mine.)
General rule of thumb: If you're doing something on the Internet, you're being logged.
Do something useful: read "Transparent Society" and/or work on making yourself a more tolerant person, rather than fretting about your "privacy" (unaccountability).
On the topic of Word: How hard is it to just have a simple word processor package?
WTF does Microsoft have to insist on throwing every single bell and whistle that the 1%'ers want into the mix. People want a small, reliable processor to type up homework and reports.
They went on the right track with their installation process, which splits up Word into it's vital components, and lets you choose which to install. But what good is that if it still installs components that you don't want, and don't trust on your machine (such as the topic)?
If I distributed an HTML document which had references to images or other objects on some website, every user opening that HTML document would cause an access to that web site.
.jpg) with *anything* that is web aware the exact same thing will happen.
And if you read *any* document with a ref to an outside object (like a one pixel
However, if you read the document in Wordpad or some other text only program you can avoid the effect. Makes for some pesky reading around markup and junk, but you will see the refrences to the web too.
Visit DC2600
Eve Fairbanks says I drive a hybrid!LOL
what are those curious little dots that appear and disappear on /. as the page loads, like right above the banner ads?? Are we being web-bugged even as we talk about it?? :))
However, looking at page source it looks like something to do w/ pagecount, but you got us wondering about any image w/ WIDTH=1 HEIGHT=1
try { do() || do_not(); } catch (JediException err) { yoda(err); }
When I am in Vindoz I use ZoneAlarm as a firewall which asks me if I want an application to access the Internet when an attempt is made. I have never had any Office component attempt this but I like knowing if and when Word or anything else tries...
Do your best, hope for the best, suspect the worst.
And they're *not* viewed in a web browser. Indeed, it's a good way to get an "opened" receipt when you send email (even if they choose not to acknowledge the usual "reciept requested" flag): embed a graphic from your own site and their client will automatically fetch it when they open the message. Cookies, too.
Clever, but not new. Why the big MSFT-is-evil hype about this?
Here's an actual reason to send your resume in Microsoft Word format -- you can track who at the company is reading it and when. Put a bullet graphic on your web site, hold your nose and go to Kinko's to save your resume in Microsoft Word format, and sit back and track it.
"Hi, this is Bob. I'm applying for the Internet security position, and I'm calling about my resume which you're looking at right now on your Macintosh." Freak them out but get the job.
Mapping IP addresses to user names and phone extensions is a simple matter of social engineering and common sense.
-- Real free software sites don't use GIFs.
I hate the term "web bug". Actually, I'm more offended at the people who come up with these stupid terms rather than the potential abuse they bring about.
I propose that we direct our energies to tracking and hunting down people who come up with these terms and sending them to Texas. I'm sure they'll know what to do about them down there.
-- You see, there would be these conclusions that you could jump to
ln -s `which strings` /usr/local/bin/word
GNU emacs can do all of these things to (including harboring document virii). What's the diff?
I've notice some spam that would try to fetch a graphic from a website. They track your address in the image location so they know who's getting it and who isn't. We need a backwards firewall to prevent traffic like this from leaving.....
I can't wait to find out what other "innovation" gems are still out there.
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
My name is Bill Gates. I have just written up an e-mail tracing program that traces everyone to whom this message is forwarded to. I am experimenting with this and I need your help.
Forward this to everyone you know and if it reaches 1000 people everyone on the list will receive $1000 at my expense.
Enjoy.
Your friend,
Bill Gates
Damn! This was totally true and I missed out!
-------
We want some answers and all that we get
Some kind of shit about a terrorist threat
- Ministry
They don't know the difference between an app and a document.
A=B=C -> A=C
It logically follows that they don't know the difference between a document and an OS. There is further practical proof of this from the way you can open configuration windows from their help files.
Ergo, the next version of MS-Windows will be called MS-Help. Instead of CTRL-ALT-DEL to log in, you'll use F1. Every time you want to type something in, you'll need to reassure your computer that you are indeed familiar with the operation of a keyboard, and probably still be forced to repeat the "This is the space bar. This is what we call the home row." tutorial every time you reboot.
--------
Why on earth do you even need them? I mean, you (the /. team) have full control of the server, right? So why use a goofy hack like 1 pel images?
It seems to me that it's lazy and irresponsible to require an extra http request.
--------
You could probably hack up some magic stuff to page you when someone opens your resume, too. After all, this technique would really only be effective if you catch them in the act.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
MS just took the next logical step. They built a feature into the application that programmers had been scripting into it for years.
- I don't care if they globalize against free speech. All my best free thoughts are done in my head.
I cannot stress this enough, people. Read the articles referenced by slashdot before you post obvious questions.
The article clearly states:
So I would imagine that the answer is "yes. Someone has checked."
Or maybe you mean a more advanced architecture -- one that could apply different security models to code depending on whether it was being executed from a local or remote source, and which put potentially "suspect" applications into a limited sandbox? (Why, that sounds an awful lot like Java, circa the mid-90s...)
Basically, Microsoft, however good they are at UI design, code reuse, or marketing, often drops the ball when it comes to security. They push the envelope of functionality far before they're ready to deal with the vulnerabilities that it can cause. That wouldn't even bother me so much if they didn't try to pass their tools off as "secure by default," and keep problems and risks under wraps until they can be silently patched in the next service pack.
As well as any other Office applications, when they launch an HTML type of document. It's pretty easy to grant permission this one time only, too -- so you always know if programs that normally shouldn't be net-enabled are trying to slip one past you.
Clearly you don't realize how either the "Internet Explorer component", or ZoneAlarm, works. Though Word uses the same HTML renderer, it is from within its own EXE. Granted, I don't kid myself that this will trap ALL instances of non-obvious internet use, but it goes a long way towards making me feel like I'm still in control.
----
lake effect weblog
{Network engineer in Chicago--looking for work!}
Ok, so if the Privacy Foundation is so upset about web bugs in MS Word documents, why does their OWN ADVISORY have a web bug in it? My filter (Guidescope) caught this little sucker: http://www.privacyfoundation.org/graphics/1pix.gif
(Awaiting an explanation.)
==
This post sponsored by the American Obstetrics Society: