Slashdot Mirror
Microsoft Confirms Excel Zero-Day Attack
Guglio writes "Eweek has a story about a new, undocumented Excel flaw that is being used in a targeted attack against an unnamed business. The latest zero-day attack comes just two days after Patch Tuesday (coincidence?) and less than a month after a very similar, 'super, super targeted attack' against business interests overseas. The back-to-back zero-day attacks closely resemble each other and suggest that well-organized criminals are conducting corporate espionage using critical flaws purchased from underground hackers."
If Criminal orgs are purchasing exploits, why doesn't Microsoft? (it's not like the don't have the money!)
Anyone have any clue what is under attack?
"...suggest that well-organized criminals are conducting corporate espionage using critical flaws purchased from underground hackers."
Are you implying that hackers don't have the wherewithal to pull off corporate espionage? Can they do nothing more than crack the latest version of VirtuaGirl?
Well organized criminals conducting corporate espionage, complex software running international corporations, (hackers/crackers) slipping deviously bugged code into the works for their own nefarious purposes.
I don't need to RTFA, I can just wait for the movie.
Trying to use sarcasm in text-based forums does not work.
The Trojan arrives as a Microsoft Excel file attachment to a spoofed e-mail with the following name: "okN.xls."
Hmm, I guess I should rename my spreadsheet containing a list of Oklahoma natives.
This guy's the limit!
It should really be called the -28 day attack, or something along those lines, since they are coordinating it to fall shortly after Microsoft's retarded "we only fix security once a month" schedule.
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Just upgrade to Windows VISTA (when it's out) and Office 2007 (when it's out) and all of these silly security issues will go away....
Oh wait, didn't they say that when they released Windows 98, Windows ME, Windows 2000, Windows XP, Windows 2003 Server, Office XP, & Office 2003? HMMMMMMM. This could be a pattern forming.
STFU & GBTW
You can't go running around with a business without a name! Focus groups people, focus...
Is diffing binaries THAT hard to do? *Rolls eyes*
"If Criminal orgs are purchasing exploits, why doesn't Microsoft? (it's not like the don't have the money!)"
Microsoft lets these exploits run free to keep the cattle in line. They need to keep people upgrading and buying the latest versions of their products to keep the cash flowing. If they released a well-written, stable, secure piece of software, what reason would people have to upgrade?
They're very neat people. Not the jolt-can and pizza-box crowd...
Clean cubicles, every one of em. And well groomed, too.
When will people learn about MS orifice... oops I mean office.
The attack comes only few days after Google announces own spreadsheet...
Why is this news? If users are willing to click on an attachment from someone they don't know, then of course they're extremely vulnerable. Of course, the problem is made worse by the fact that MS makes it so difficult not to run with administrator privileges. If this is really targeted at a particular business, then the solution seems pretty simple: that business tells all their employees not to click on attachments from people they don't know, and whips up some software to filter out this stuff before it even gets to their users. If they're big enough to be an attractive target for extortion, they're presumably big enough to have an IT staff competent to take care of those simple steps.
Find free books.
It is not a popularity problem - it's a "our marketing and sales departments delegate everything to our engineering and security departments" problem.
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Everyone knows that you should not open attachments. Word is likely full of 1000s of exploitable holes. Excel too. Plus any other complex program.
:)
Yes, OpenOffice will be full of holes as well.
Not news.
As for attacking just after the patch cycle, it's unlikely to mean anything. If I wanted to take advantage of a vulnerability for as long as possible, I would attack two or three days before the patch cycle. That will give people a couple of days to work out what happened and report the issue to Microsoft. After some initial analysis and prioritisation, a developer will be assigned to fix it. By that time it will have missed the boat for this month's patch day. Not that I would do this though.
I'll probably be modded down for this...
Do not run the fishy excel files?
.exe files, but I may run the .xls files even I don't know the identity file.
I don't run the suspicious
In this instance, however, it is being hypothesized that an organized group is responsible. That's a centralized target; likely to yield more than one guy in his basement wearing shorts and a coffee-stained t-shirt, drinking coffee and jolt and living off old pizza.
So, to CERT (and their international counterparts) I say - "Go get 'em, boys!"
The thing is, to be a good hacker, you kinda have to spend a lot of time and energy on hacking. At the end of the day, it's probably easier and equally lucrative to just sell your exploits to other people rather than using them yourself. It's also a much safer route legally speaking because you aren't directly involved in the criminal act, you're just selling the tools.
This sig has been temporarily disconnected or is no longer in service
Patches for this problem available here, here and here.
against an unnamed business
I think they should be more worried that they are the victim of identity theft .
I'll probably be modded down for this...
I do not believe that e-mail spamming attack against a single company can be that effective. Very low percentage of e-mail users, especially professionals, actually open the attachments in unsolicited e-mails.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Must be the work of terrorist cells...
With an open file format such as OpenDocument, it would be much harder to hide malicious code and/or exploits in a document...
You could easily parse the file at your gateway, and validate the xml content against the published schema (rejecting it if it fails), although this wouldn't be foolproof (an exploit could still exist within well formed xml, but is less likely) it would cut out a significant portion of vulnerabilities.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Anyone here thinking it's a coincidence that the exploit goes life JUST after "patch day"?
I don't want to call the responsible people at MS retards, who thought that patching at one very predetermined day every month is a good idea, but my English is not good enough to come up with a better name for this kind of idea.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Yes, because there is no way that the attacker could have come up with the attack him/her-self. It's completely out of the question that this person could have done it alone. Even though we know absolutely nothing about [him/her, them]. etc It certainly makes far more sense to introduce a conspiracy theory. One involving vast crime rings.
Sure.
located in Redmond, WA. The Chief Software Architect of the unnamed business also works a second job and hangs out with world leaders in his spare time, curing cancer.
In the average office, MS-Office documents fly low. Mail is still THE way to transport documents between companies.
If you now expect your employees not to open MSO documents, you pretty much expect them not to work.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You had it right the first time...
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Do you get executable code in a SPREADSHEET!?!
Seems like another MSFT "feature".
Tom
Someday, I'll have a real sig.
Between this stuff, WGA, and just general principle I'm not sure I'll ever boot XP again. Just gotta figure out how to run Party Poker on Lx...
My turnips listen for the soft cry of your love
But 'backwards compatibility' made Windows the (in)famous clusterfsck it is.
Imagine how stable and secure Windows would be if Microsoft rewrote and streamlined it (goodbye
There is more to life than 'just making a buck', but when this is done at the corporate level, it transforms everybody it touches to seen-it-all, done-it-all cynics who keep their funds close to them, part with them only when necessary (food/clothing/shelter/heat/lights/vehicle fuel and maintennance/public transport fares/occasional recreational spending) and do anything they can to escape its clutches (i.e. use adblock when online, and A/V devices capable of 'adskipping').
(I 'posted' the text below in an earlier comment here but I can't find the link to it right away. Note, I'm not a shill for this guy, just an admirer of simple, elegant, secure C program code that I can learn from and use in future projects.... It would be nice if the following, complete text was on a standard webpage instead of being imbedded in a compiled HTML file (.chm) =/ )
Why doesn't anyone employ these hackers to attack spam companies. It would be using one destructive web force against an annoying one, after all, I'm sure they get spam too. The enemy of my enemy is my friend.
Oh boy! Sure!
Do you really think there is a little department at Redmond that is in charge of 'exploits running free'?
Honestly. Sometimes I think slashdotters should get their fucking heads out of their assholes and smell the fresh air!
Microsoft's fuckup is not in choosing to release their patches on a scheduled basis. They really had no choice in the matter. Their fuckup is in letting their security situation get so bad, they had to produce a large number of patches every month.
It would be embarrassing for Microsoft to come to terms with the fact that they are, in fact able to purchase these exploits when their own people in possession of the source code and staring at it day in and day out cannot find them.
You're basically arguing that Microsoft should subsidize the discover of security flaws. In an academic setting, this would probably be a good thing with the end result being a better understanding of the information technology industry. But if Microsoft is buying from black hats, then rather than subsidizing research that makes everyone more secure, Microsoft is essentially subsidizing 0 day exploits.
Go listen to Edwyn Collins. That's some patch for you.
they sky is blue!
;) and hackers are getting better at finding them now
water is wet!
these microsoft is being exploited again articles get kinda funny when you see one every few days
and a critical one every 1-3 weeks
cant even go a month without major exploits on windows
its either a sign of completely lousy untrustable crap code, or that they are purposely leaving backdoors in there for some evil purpose
*hugs ubuntu*
/. is quickly becoming a verb, irrelevent. They have a hot story about a security flaw, targeted attack and economic damage to one corporation without a trace of realism anywhere to be found. Not in the lead-in story, comments, or even in the interface. Yeah, this Wiz-bang 2 week old upgrade that managed to only change the window dressing. At least, the very least, a competent UI designer would have added a "drop down" menu to the UI.
:: 5 "Funny", 5 "First P0st", 5 "TinHat", etc...
New drop down UI:
No Bullshit = no
Just Laughs = "Funny"
Hacker's, the good ones, can earn a decent living playing both sides of the game. A cheesy salary on the inside and much more lucrative compensation from the outside. An organized distribution of hackers, not necessarily organized consciously by hackers, but by an outside interest is a growing threat to corporate interests.
One company does not an economic threat make, but one product does an Industry take down. And really, that is all they have to accomplish - one Industry; at a time.
It looks like Slasdot.org, is the first. If the cheesy new UI is any indication.
It's not a strange email - it's from someone in your company with a spreadsheet attachment. Worms are sophisticated these days.
You better watch out, there may be dogs about . .
The obvious solution is to get rid of the buffers. I suggest replacing them with fluffers. And retaining production rights to the movie based on resulting fluffer overflows. Profits would snowball!
Eloi are stupid, throw morlocks at them!
Their site is down right now. ;-)
http://cnn.com/
Sounds like a DREAMLAND to me! Almost everywhere I've ever worked, Marketing & Sales acted like they were Engineering and/or Security; dreaming up new products/features/services/abilities/laws of physics/superpowers/etc. and making surprise announcements to the CEO and other VIP's :
while the developers' jaws all hit the floor...
This space intentionally left (almost) blank.
If you ban exploits, then only the criminals will have exploits.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
it makes me just a little more glad that I've already migrated nearly all my clients to OpenOffice.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Agreed. "Bring 'em on!"
Oops. That might be a mistake.