Slashdot Mirror
First StarOffice Virus Sighted
Sam Haine '95 writes "News.com is reporting on the creation of Stardust, a virus which uses macros to attack StarOffice, Sun's office suite. The malware was written as a proof-of-concept code to show what might be possible rather than as a serious attempt to create a new attack vector." From the article: "The pest is written in Star Basic. It downloads an image file with adult content from the Internet and opens that file in a new document, according to Kaspersky's posting."
First, a question, I don't know what the default setting for StarOffice is as to macro execution. Is it turned on by default?
Regardless, it's no secret of mystery even if by default macro execution is on in StarOffice, the vulnerability is in the OS infrastructure. If this happened on a Un*x machine (Sun, HP, Linux, BSD), the damage would be confined and limited to what the user had unprotected. It would be highly unusual for a Un*x user hit with a StarOffice macro exploit to have enough exposure to compromise the system.
OTOH, while it is getting better in Windows, there are still far too many users set up with admin privileges, and we're a long way from sufficient education and reconfiguration such that a typical Windows user has safe access so exploits succeed in only local impact.
Macros in documents are almost evil, I hate that everything sent somehow has to have its own life-force, but in properly configured systems, they're manageable. (I don't object to macros, I use them all the time, but to make them "required" to get the full effect of e-mail is annoying.)
What? No link to the "adult content?"
It downloads an image file with adult content from the Internet and opens that file in a new document, according to Kaspersky's posting.
I don't call that a virus, I call it a feature.
Hopefully the next version will allow you to enter keywords to guide the image downloader.
If this signature is witty enough, maybe somebody will like me.
It downloads an image file with adult content from the Internet and opens that file in a new document
That's no virus, that's a productivity tool!
This guy's the limit!
Is this really a virus. It downloads and displays and image with adult content, and displays it. It doesn't run any malicious code, doesn't touch your file system, and doesn't leave any trace after it has run. Sure, you may get in trouble at work, if it downloads the single image, but I think that most IT departments would understand, and wouldn't be able to do much for you for downloading a single image with adult content.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
The more open source products get used, the more their authors will realize that it's not enough to be l33t to write a secure product.
It will also require tough and down-to-the-ground tough work such as researching the worms out there and patching the product out.
Another thing is: you can never "fix" the user, there will always be the guys to run attached executables that promise hot porn and FREE MONY!.
If you want to trick someone into viewing an image, why not just embed the image in the document?
Where is the "proof" (and the "virus") in this "proof of concept virus"?
I'm all for protecting users from their own stupidity, but in the end, there's a point where people stop having any power at all.
I've floated the idea of a multicast based worm capable of infecting anyone who is accessing a multicast stream. I came up with this idea after some CCNP studies while doing some multicast tests. For those who need a briefer on how multicast works: What is Multicasting ? Multicasting is a technique developed to send packets from one location in the Internet to many other locations, without any unnecessary packet duplication. In multicasting, one packet is sent from a source and is replicated as needed in the network to reach as many end-users as necessary.
In my theory, a virus creator need create say a corrupted image, sound, etc., and send it through networks as a spoofed source. For example, MSN, AIM, Yahoo! messengers all stream annoying advertisements, so what's to stop someone from creating a packet injection tool to stream a virus through to everyone listening for the multicast and infect their machine.
Let D=Disney A=Attacker M=Multicast_Address DST=Destination... If A spoofs D sending bad data to M's DST... How many machines can possibly get infected. The framework is there and the possible outcome would be mass infections on a worse level then any worm seen. Of course the whole notion is conceptual but I'm sure it can be done.
Anyhow in relation to the article, there is no mention of which operating system this PoC affects but I'm sure it will only be a matter of time before someone creates all sorts of perl, sh, python scripts to try and make Unix zombies or so. Luckily I know of no colo places using StarOffice on big piped networks, so DDoS drones are unlikely to come out of this. Simply infected machines... Will be strange to see what else comes out of this.
Infiltrated dot Net
Me? Looking at porn at work? Noooo, sorry, must be that virus goin' round.
A heartfelt THANK YOU to the autor!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Cool... Thanks for the idea!
Respectfully Signed,
Anonymous Redmond Washington Resident
Get your Windows Malicious Software Removal Tool Here for FREE! - http://fedora.redhat.com
If you're in a company and a "virus" takes out one of the system files on one of your servers ... but the data is safe, you have less of a problem than if a "virus" leaves the server intact, but deletes all of your data.
... the risk is greater that your hard drive will fail before you get a "virus" on your Linux box. With a failed hard drive (and no backup), you've lost all your data. At some point, it is up to the admin (the user in this case) to back-up his/her data. There is a point at which the OS/app's responsibility ends and the admin's begins.
It's always about the security of the data.
Which is why part of the OS's job is to restrict the ability of regular users as much as possible.
When all that is in danger is your personal home directory, that's really as good as the OS can be.
If we're talking single user/home machines
Pardon me for asking but doesn't the definition of a virus include duplication? All I hear is that some code can download a picture. How does it "reproduce" itself and infect other stations?
What? No link to the "adult content?"
be careful what you wish for... the 'adult content' could be goatse
There are 10 types of people in this world, those who can count in binary and those who can't.
Both StarOffice users have been contacted and were warned to be careful.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.