Slashdot Mirror
Microsoft Confirms Excel Zero-Day Attack
Guglio writes "Eweek has a story about a new, undocumented Excel flaw that is being used in a targeted attack against an unnamed business. The latest zero-day attack comes just two days after Patch Tuesday (coincidence?) and less than a month after a very similar, 'super, super targeted attack' against business interests overseas. The back-to-back zero-day attacks closely resemble each other and suggest that well-organized criminals are conducting corporate espionage using critical flaws purchased from underground hackers."
Anyone have any clue what is under attack?
"...suggest that well-organized criminals are conducting corporate espionage using critical flaws purchased from underground hackers."
Are you implying that hackers don't have the wherewithal to pull off corporate espionage? Can they do nothing more than crack the latest version of VirtuaGirl?
Well organized criminals conducting corporate espionage, complex software running international corporations, (hackers/crackers) slipping deviously bugged code into the works for their own nefarious purposes.
I don't need to RTFA, I can just wait for the movie.
Trying to use sarcasm in text-based forums does not work.
The Trojan arrives as a Microsoft Excel file attachment to a spoofed e-mail with the following name: "okN.xls."
Hmm, I guess I should rename my spreadsheet containing a list of Oklahoma natives.
This guy's the limit!
It should really be called the -28 day attack, or something along those lines, since they are coordinating it to fall shortly after Microsoft's retarded "we only fix security once a month" schedule.
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Just upgrade to Windows VISTA (when it's out) and Office 2007 (when it's out) and all of these silly security issues will go away....
Oh wait, didn't they say that when they released Windows 98, Windows ME, Windows 2000, Windows XP, Windows 2003 Server, Office XP, & Office 2003? HMMMMMMM. This could be a pattern forming.
STFU & GBTW
You can't go running around with a business without a name! Focus groups people, focus...
Is diffing binaries THAT hard to do? *Rolls eyes*
"If Criminal orgs are purchasing exploits, why doesn't Microsoft? (it's not like the don't have the money!)"
Microsoft lets these exploits run free to keep the cattle in line. They need to keep people upgrading and buying the latest versions of their products to keep the cash flowing. If they released a well-written, stable, secure piece of software, what reason would people have to upgrade?
They're very neat people. Not the jolt-can and pizza-box crowd...
Clean cubicles, every one of em. And well groomed, too.
When will people learn about MS orifice... oops I mean office.
Why is this news? If users are willing to click on an attachment from someone they don't know, then of course they're extremely vulnerable. Of course, the problem is made worse by the fact that MS makes it so difficult not to run with administrator privileges. If this is really targeted at a particular business, then the solution seems pretty simple: that business tells all their employees not to click on attachments from people they don't know, and whips up some software to filter out this stuff before it even gets to their users. If they're big enough to be an attractive target for extortion, they're presumably big enough to have an IT staff competent to take care of those simple steps.
Find free books.
It is not a popularity problem - it's a "our marketing and sales departments delegate everything to our engineering and security departments" problem.
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Everyone knows that you should not open attachments. Word is likely full of 1000s of exploitable holes. Excel too. Plus any other complex program.
:)
Yes, OpenOffice will be full of holes as well.
Not news.
As for attacking just after the patch cycle, it's unlikely to mean anything. If I wanted to take advantage of a vulnerability for as long as possible, I would attack two or three days before the patch cycle. That will give people a couple of days to work out what happened and report the issue to Microsoft. After some initial analysis and prioritisation, a developer will be assigned to fix it. By that time it will have missed the boat for this month's patch day. Not that I would do this though.
I'll probably be modded down for this...
Do not run the fishy excel files?
.exe files, but I may run the .xls files even I don't know the identity file.
I don't run the suspicious
In this instance, however, it is being hypothesized that an organized group is responsible. That's a centralized target; likely to yield more than one guy in his basement wearing shorts and a coffee-stained t-shirt, drinking coffee and jolt and living off old pizza.
So, to CERT (and their international counterparts) I say - "Go get 'em, boys!"
The thing is, to be a good hacker, you kinda have to spend a lot of time and energy on hacking. At the end of the day, it's probably easier and equally lucrative to just sell your exploits to other people rather than using them yourself. It's also a much safer route legally speaking because you aren't directly involved in the criminal act, you're just selling the tools.
This sig has been temporarily disconnected or is no longer in service
Patches for this problem available here, here and here.
against an unnamed business
I think they should be more worried that they are the victim of identity theft .
I'll probably be modded down for this...
I do not believe that e-mail spamming attack against a single company can be that effective. Very low percentage of e-mail users, especially professionals, actually open the attachments in unsolicited e-mails.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Must be the work of terrorist cells...
With an open file format such as OpenDocument, it would be much harder to hide malicious code and/or exploits in a document...
You could easily parse the file at your gateway, and validate the xml content against the published schema (rejecting it if it fails), although this wouldn't be foolproof (an exploit could still exist within well formed xml, but is less likely) it would cut out a significant portion of vulnerabilities.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Anyone here thinking it's a coincidence that the exploit goes life JUST after "patch day"?
I don't want to call the responsible people at MS retards, who thought that patching at one very predetermined day every month is a good idea, but my English is not good enough to come up with a better name for this kind of idea.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
located in Redmond, WA. The Chief Software Architect of the unnamed business also works a second job and hangs out with world leaders in his spare time, curing cancer.
Tankersley
In the average office, MS-Office documents fly low. Mail is still THE way to transport documents between companies.
If you now expect your employees not to open MSO documents, you pretty much expect them not to work.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You had it right the first time...
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Between this stuff, WGA, and just general principle I'm not sure I'll ever boot XP again. Just gotta figure out how to run Party Poker on Lx...
My turnips listen for the soft cry of your love
But 'backwards compatibility' made Windows the (in)famous clusterfsck it is.
Imagine how stable and secure Windows would be if Microsoft rewrote and streamlined it (goodbye
There is more to life than 'just making a buck', but when this is done at the corporate level, it transforms everybody it touches to seen-it-all, done-it-all cynics who keep their funds close to them, part with them only when necessary (food/clothing/shelter/heat/lights/vehicle fuel and maintennance/public transport fares/occasional recreational spending) and do anything they can to escape its clutches (i.e. use adblock when online, and A/V devices capable of 'adskipping').
(I 'posted' the text below in an earlier comment here but I can't find the link to it right away. Note, I'm not a shill for this guy, just an admirer of simple, elegant, secure C program code that I can learn from and use in future projects.... It would be nice if the following, complete text was on a standard webpage instead of being imbedded in a compiled HTML file (.chm) =/ )
Do you get executable code in a SPREADSHEET!?!
Buffer overflows
Why doesn't anyone employ these hackers to attack spam companies. It would be using one destructive web force against an annoying one, after all, I'm sure they get spam too. The enemy of my enemy is my friend.
Microsoft's fuckup is not in choosing to release their patches on a scheduled basis. They really had no choice in the matter. Their fuckup is in letting their security situation get so bad, they had to produce a large number of patches every month.
Anything beyond basic usage requires a macro language--especially a spreadsheet program. Now, whether the macro language should be allowed to interface with the filesystem is a different matter entirely. I'd say that a user should be given a standard "Overwrite file $FILENAME? yes/no/cancel" dialog whenever a macro tries to overwrite a file; opening or listing the contents of a directory is a bit of a tricky matter, but I don't think many users would miss that feature.
Now, if the macros were available to an external scripting language like bash or one of the P's, then there would be no reason for the macro language to be able to list or open files, only write to them. Then you'd only have, as the above poster mentioned, buffer overflows and the like.
If we wanted, we could alter our standard libraries so that, for instance, strcpy does bounds checking. Is there a reason not to?
It would be embarrassing for Microsoft to come to terms with the fact that they are, in fact able to purchase these exploits when their own people in possession of the source code and staring at it day in and day out cannot find them.
Or alternatively have digitally signed macros and don't allow any non-signed macros to run.
You're basically arguing that Microsoft should subsidize the discover of security flaws. In an academic setting, this would probably be a good thing with the end result being a better understanding of the information technology industry. But if Microsoft is buying from black hats, then rather than subsidizing research that makes everyone more secure, Microsoft is essentially subsidizing 0 day exploits.
Ahh, see, there's the bad assumption. There are a LOT of really bad prograamers... nay, that's an insult to those of us who know what we're doing. I don't knwo what to call them. And they are all over the place, writing "enterprise" software. For more info, read The Daily WTF.
In this case it isn't a macro, they're using a buffer overflow error in the code that loads and interprets MS-Office files.
Basically, what happens is that the Office reading routine creates room on the stack for some variable, to hold X bytes. Right behind those X bytes, there is the return address for the subroutine (so the reader subroutine can actually come back to the original program).
Now, this return address is being overwritten by an address that points into the spreadsheet instead (it's not THAT simple, but that's the general idea behind it). And in that area of the spreadsheet, you don't find spreadsheet data but instead you have executable code. Which is then, of course, executed (because Office thinks it's "his" code).
Quite simple. And easily avoided (the way to do it can be seen below in another subthread, by a rather good example).
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
To be fair it's half and half ... well one feeds into another.
At the beginning "programmers" were hobbyists who learned it because they were interested and took it seriously. But more and more as things got commodidized managers looked for people who got things in quicker. And by quicker I mean cut corners. So that in turn bred the generation of really shitty programmers [who often call themselves "developers"].
Now you got both shitty "coders" and shitty managers who just won't take "it'll be ready when it's ready" as an answer.
Final result: We the paying customers get shit products.
Tom
Someday, I'll have a real sig.
/. is quickly becoming a verb, irrelevent. They have a hot story about a security flaw, targeted attack and economic damage to one corporation without a trace of realism anywhere to be found. Not in the lead-in story, comments, or even in the interface. Yeah, this Wiz-bang 2 week old upgrade that managed to only change the window dressing. At least, the very least, a competent UI designer would have added a "drop down" menu to the UI.
:: 5 "Funny", 5 "First P0st", 5 "TinHat", etc...
New drop down UI:
No Bullshit = no
Just Laughs = "Funny"
Hacker's, the good ones, can earn a decent living playing both sides of the game. A cheesy salary on the inside and much more lucrative compensation from the outside. An organized distribution of hackers, not necessarily organized consciously by hackers, but by an outside interest is a growing threat to corporate interests.
One company does not an economic threat make, but one product does an Industry take down. And really, that is all they have to accomplish - one Industry; at a time.
It looks like Slasdot.org, is the first. If the cheesy new UI is any indication.
It's not a strange email - it's from someone in your company with a spreadsheet attachment. Worms are sophisticated these days.
You better watch out, there may be dogs about . .
The obvious solution is to get rid of the buffers. I suggest replacing them with fluffers. And retaining production rights to the movie based on resulting fluffer overflows. Profits would snowball!
Eloi are stupid, throw morlocks at them!
Their site is down right now. ;-)
http://cnn.com/
If we wanted, we could alter our standard libraries so that, for instance, strcpy does bounds checking. Is there a reason not to?
We did that. It's called strncpy. If you want better than that, you're going to have to make an entirely new language to get it. But if you decide to make this hypothetical language (which I call "Java", but it's kind of a silly name so I don't think it will catch on, but you could abbreviate it to something really catchy like "J2SE"), please try very hard not to make it so simple applications take up 40 megs of memory. That would suck.
So we're in agreement!
The Rand Coporation, in conjunction with the saucer people, under the direction of the reverse vampires are introducing zero-day Excel exploits!
Sounds like a DREAMLAND to me! Almost everywhere I've ever worked, Marketing & Sales acted like they were Engineering and/or Security; dreaming up new products/features/services/abilities/laws of physics/superpowers/etc. and making surprise announcements to the CEO and other VIP's :
while the developers' jaws all hit the floor...
This space intentionally left (almost) blank.
If you ban exploits, then only the criminals will have exploits.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
it makes me just a little more glad that I've already migrated nearly all my clients to OpenOffice.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Agreed. "Bring 'em on!"
Oops. That might be a mistake.
I somewhat doubt that this would help. The stack by itself is not executed. You only pop the return address from the stack, which is the standard routine for subroutine return code handling in i80x86 machines (and most other stack based microprocessors).
Even if the A64 used a different subroutine handling mechanism, it would have to be compatible with the "normal" way in i80x86 machines. Since return address manipulation is not so unheard of in "normal" programs (executable packers, code obfuscation schemes and copy protections make heavy use of it), the A64 would have to behave "normally" or it could not execute such code either.
And the normal behaviour is unfortunately to not check where that return address points to.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.