Slashdot Mirror
Holes in PowerPoint and Excel
jeffy124 writes: "Looks like it's time for IIS and Outlook to make room on the pedestal of security holes. Just about every recent version of PowerPoint and Excel are vulnerable to being taken over to control the system remotely. The hole is a macro-related, as it's possible to bypass asking the user if they'd like a macro to run. Microsoft's advisory can be found here."
Funny. I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?
Customers using Microsoft® Excel or PowerPoint for Windows® or Macintosh® I guess Mac uses can stop complaining that they don't get all the features of the Windows version.
These things first appeared in 1996 or so. Word.Concept or what was it called. Microsoft responded by disabling the AutoLoad macro (or whatever it's called). Now somebody found a new way to make Excel/etc. execute stuff when loading a file. Big deal.
I wonder why virus writes bother at all. They can just put a button labeled "Click here" on the page, and 95% of the lusers will click it. The only defense against that is just disabling all macro support. And everybody knows that isn't going to happen.
Actually, Emacs mixes data and code in the same way. Check the File Variables section in the info system, and in particular the enable-local-eval variable. Basically, you can set buffer local variables by embedding the commands for this at the end of the file. One of these variables is 'eval' :-). Thus spake RMS:
In this sense Emacs is just as guilty as Microsoft Office. Just because it's Free doesn't mean it is without security free. (But the fact that the average person using Emacs is more clued in than you Power Point suit, does help...)
Hi!
You know, I think that if the former versions aren't vulnerable, they're not gonna tell you. They just can't take the risk to have people want to revert to older versions on the basis that they "work better", not when their business relies so much on people upgrading over and over...
-- B.
This sig does in fact not have the property it claims not to have.
I always thought that PowerPoint was already at least as destructive as macro viruses to corporate productivity. You ever watch a suit fiddle with his presentation?
How does that hurt productivity? You seem to be implying that the suit would be doing something productive if he weren't using PowerPoint.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Come on, Powerpoint is the de facto standard.. Don't expect millions of business users to jump through hoops just because 'M$ sux0rs'
Unfortunatly, you ahave a point. Apparently, the billions of dollars wasted on cleanup after the MS exploit of the day haven't convinced enough people.
Perhaps macro viruses need to touch on corperate hotbutton issues in order for the suits to start thinking.
Perhaps the sexual harassment virus. You get it and it starts sending sexually harrasing email to your coworkers. If done well, the courts could be tied up for decades.
The IP virus, looks for documents containing trade secrets, and quietly posts them to random usenet groups.
Porn virus: Quietly downloads porn into your browser cache. Bonus points if the porn is illegal where you live.
Carnivore virus. Sends suspicious emails to the targets of FBI investigations.
Rootkit virus: Deploys a rootkit from your machine against a bank or government website. Instant felony.
Please note! I don't condone any of these, I just recognise that so far the holes in MS products have been used primarily for childish pranks rather than for real damage.
The least MS could do is at least TRY to limit the damage by putting macros in some sort of sandbox.
Emacs does include some features that are equivalent to these sort of macros. They are disabled by default
And they used to be enabled by default - which was a big vulnerability if you used them as a mail reader or netnews reader. A simple string embedded in the letter or posting could do anything YOU could do in emacs - which means anything you could do from a shell, too.
Fortunately the first well-known public exploit was a netnews posting demoing the bug by popping up a window and telling you how to turn it off. The default was changed in the next release.
The days of the MIT AI lab were a more innocent time. To keep the students from crashing the machine they made it trivial - with a well-documented command to do it. The idea being that if there were no reputation points to be earned by "finding a way to crash the machine" but lots of negative ones to be had by annoying the other students, everybody would get bored with it quickly. Stallman continued the tradition later by having no root password on his personal machine for quite a while.
Unfortunately, about one person in a hundred (one in 50 to one in 200) is a psychopath - a person with a brain problem analogous to color blindness that amounts to "no concience". Some fraction of these don't compensate by learning that hurting others is bad for number one and becoming "good" by deliberate effort.
So when you have hundreds of millions of people on the internet, you end up with a few "black hat" hackers and a host of script kiddies. So the days of innocence (and Stallman's open root account) are long over.
Now internet-connected computers hold information of value that can be stolen and run mission-critical functions for businesses with cutthroat competitors. So a management order to install mass-market stoftware with a history of well-known major security holes has graduated from administrative cluelessness to a severe breach of fiduciary duty.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
sig?