Slashdot Mirror
Online Document Search Reveals Secrets
An anonymous reader writes "New Scientist is reporting that many documents published online may unintentionally reveal sensitive corporate or personal information, according to a US computer researcher. Simon Byers, at AT&T's research laboratory in the US, was able to unearth hidden information from many thousands of Microsoft Word documents posted online using a few freely available software tools and some basic programming techniques." Update: 08/16 19:06 GMT by H : The story is originally from Crypto-gram, not New Scientist.
From the article:
I just created a Word document, blah.doc and put some text into it. I made sure I had a couple of undo points. I closed it and opened it back up, I couldn't undo SHIT. So where the hell am I being granted this mysterious "convenience?"
I know that the guy stressed the fact that Micrsoft isn't alone in this disctinction, but this is just another example of why Microsoft SUCKS.
I put the doc in a samba share and viewed it with vi. I found the path to the doc, the original name, my userid on my laptop, and the company name. All were hidden from the simple searches like this:
s.l.a.s.h.d.o.t...o.r.g
WTF?!?
Oh, WAIT a minute! This is also from the article:
WHEW! I feel so much better. Please disregard the first six paragraphs. Thanks.
Mom says my
Simon Byers, at AT&T's research laboratory in the US, was able to unearth hidden information from many thousands of Microsoft Word documents posted online using a few freely available software tools and some basic programming techniques.
Are you going to share that info or what?
Throw it up on freenet man!
Everyone should just be forced to use LATeX and then there won't be any hidden information. . .
No one can tell, man. That post is encrypted in itself.
How long until someone blames Microsoft, I wonder...
Remind me not to save my importand documents to C:\My Documents\Porn\Annual Budget Report.doc anymore.
Remember kids: strings is your friend. If you happen to get a job offer in the form of a Word document and the HR drone who sent it to you wasn't careful, you can often see the version that got sent to other candidates and, more importantly, how much money they were offered. It can do wonders for your bargaining position.
which is why you should use latex! nobody understands that stuff. security through obscurity!
2 1337 4 u!
It looks like you're trying to post a document on the web.
Would you like to...
1. Divulge corporate secrets?
2. List your passwords?
3. Remove KB823980 and open port 135?
It looks like your trying to close Clippy.
Would you like to...
1. Shit in your hat?
2. Put fist through bling bling flat panel?
3. Go home for teh weekend?
it's called http://www.google.com and you search by "top secret documents filetype:doc".
My friend go so tired of people on his team sending him word docs, that he learned TeX and started sending his replies that way. When he feels really nasty about it, he sends the .dvi files.
He says hidden information can "incredibly useful" in improving the functionality of the software. "But if some of that data is sensitive, there have to be ways of ensuring that it isn't distributed where it shouldn't be," he says.
Apparently they need to use some of the software he used to get a conjugation of the infinitive "to be" back into their text.
www.sitetronics.com/wordpress
Back in 1997, we were interviewing my putative replacement, and one fine fellow sent us a Word resume and cover letter. In the cover letter, he shared with us the delightful sentiment that-- while he was interviewing several other places (1997, remember), we were his current top choice.
A colleague on the review team who didn't use Windows turned to strings(1) to get the data from these documents, which yielded us the information that a *lot* of this guy's other prospects were also his current top choice. Maybe it was true every time he wrote it, but... I hate to think... could he have been trying to *manipulate* us?
Wow... all i have to say is wow. so i figured it'd be fun to go find kids grades and i added "grades" to your "my documents" link. guess what popped up in google? Some teacher's affair. This is kind of scary when you think about it....
Once, when negotating an investment deal, we got a Word document with the investment bank's comments on our proposed contract.
:-)
They tracked changes. All we needed to do was display them... and we got juicy stuff like "if they accept either our fix for clause X or for clause Y we can still s---w them royally in scenario Z".
Made for a very effective negotiation. For us.
Oh, wait, the article was about the problems this raises for the document's _author_.
Never mind