Slashdot Mirror
PowerPoint 0-Day Points to Corporate Espionage
Rakesgate writes "A second Trojan used in the latest zero-day attack against Microsoft Office contains characteristics that pinpoint corporate espionage as the main motive, according to virus hunters tracking the threat. This eWeek story walks through the attack, which uses a tainted 18-slide PowerPoint file, a Trojan dropper, 2 Trojans and a server in China that is used to communicate with compromised machines." From the article: "'Once this type of attack is out, it's very unusual for it to be limited to just one company. I think it's safe to assume that it's ongoing, especially since there is no patch for this vulnerability,' Huger added. Microsoft plans to issue a patch on August 8 for users of Microsoft PowerPoint 2000, Microsoft PowerPoint 2002 and Microsoft PowerPoint 2003. In the meantime, anti-virus experts are urging Microsoft Office users to be on the lookout for suspicious attachments, even those that appear to come from colleagues internally."
In the meantime, anti-virus experts are urging Microsoft Office users to be on the lookout for suspicious attachments, even those that appear to come from colleagues internally
But what if you receive a Power Point presentation from your manager called "ReadThisOrYourFired.ppt"? It looks suspicious, but oh the dilema.
"Symantec's Huger said the sophisticated nature of the attacks suggest it is the work or well-organized criminals associated with industrial espionage." Now, now, Symantec. Everyone who's seen any 007 movie knows. It's not the criminals that are taking down the evil corporation... ...it's the british. ::walks off, whistling James Bond theme::
> But what if you receive a Power Point presentation from your
> manager called "ReadThisOrYourFired.ppt"?
I'd quit. I refuse to work for anyone who can't tell the difference between a possessive pronoun and a contraction.
Who wants to take bets that someone will have a patch out there before MS does, much like with the WMF flaw?
How many more machines have to be compromised before users begin to take matters into their own hands?
The arrogance of MS is astounding. And don't say it's because of testing.
I refuse to work for anyone who can't tell the difference between a possessive pronoun and a contraction.
That's what I meant by suspicious! What were you thinking I was thinking?
I'd quit because I refuse to work for anyone who uses PowerPoint as a primary form of communication.
This guy's the limit!
I understand that some people like getting their patches every first tuesday of the month, but why force everyone to wait until the 8th. Why not let those people who are willing to risk the very small possibility of a problem caused by the patch but don't want to take the serious risk of their system getting cained by some black hat in China get the patch when they want it?... especially home users for whom a patch would pose very little problem even if it was badly written
*''I can't believe it's not a hyperlink.''
Why can't the Chinese set up thier firewalls block this kind sh*t?
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
But Al Gore uses PowerPoint. Who wouldn't want to work for him?
Well, it worked for Napoleon Dynamite....."CLICK"
----->BSOD: All Your Assets Are Belong To Us!
He who knows best knows how little he knows. - Thomas Jefferson
"Sombody needs to tell the Chinese to stop doing this shit..."
OpenOffice.org wants YOU !
why force everyone to wait until the 8th.
;)
The theory is that once the patch is out, crackers will reverse engineer it to make new exploits, increasing the security risk for other companies.
It also gives Microsoft a good excuse to be slow to patch, but that's just my own personal theory.
I'll probably be modded down for this...
Is corporate espionage actually valuable? I'm currently working at Adobe, and development plans are pretty widely discussed amongst employees. If something were to leak, I'm not sure what the value of it would be. The only real data points that are heavily protected are financial results and projections, and the product release dates that those rely on. But I'm pretty sure those are only protected for Wall Street purposes.
What kind of data do corporate spies hope to obtain? Would that data be actionable -- e.g, could a company come up with a competing product and be first to market if another company's already half way there?
my blog
I was under the impression he used Keynote. (Reference)
I'm still using Office 97.
"Do the Right Thing. It will gratify some people and astound the rest." - Mark Twain
In a situation like this? Assuming the exploit isn't looking to just get the text of the Powerpoint, but somehow index your machine. Dropping powerpoint in a seperate vm, once there is a known exploit like this would be sure to "partition" your HD would it not? while not an optimal solution, it seems to be a possible short term one.
I stand corrected.
Mr. Bad Example wrote:
>> But what if you receive a Power Point presentation from your
>> manager called "ReadThisOrYourFired.ppt"?
>
>I'd quit. I refuse to work for anyone who can't tell the difference between a possessive pronoun and a contraction.
Thank you Mr. Bad Example!
You've never worked for a big corporation with managers who think powerpoint is the pinnacle of communication and presentation, all rolled into one.
But you could still find out if it's real or not. If it is not sent with highest priority, it is definitly bogus.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
And this is not a virus: I choose to send these to my friends :-(
I'd quit because I could probably find a better job that doesn't involve using PowerPoint.
Word, Excel, IE, PowerPoint, OE, Windows itself.
I'm now preparing for the 0-day notepad exploit...
Task Mangler
Seems they've got reason to worry after all. The "we all do it" argument is bullshit. China's government is notorious for economic espionage and many of its corporations, probably most, are owned by military officers or the military as an organization. The fears about China are grounded in reality.
Enemy? Just because China is becoming a powerful nation doesn't mean you have to neutralize them before they overtake you. If America can be a powerful nation without fucking up the rest of the world, I'm sure China can do it too. Probably they'd do it a lot better actually. Stop killing everyone and try to learn how to get on with the people around you, even though they may be different to you.
I'll probably be modded down for this...
From the time of this announcement, to the time of resolution... 2 weeks is unacceptable.
How, just how, did we get to the point that a slideshow can carry a virus?
TFA says:
Once this type of attack is out, it's very unusual for it to be limited to just one company. I think it's safe to assume that it's ongoing.
Me, I think it's safe to assume there are 10 undiscovered corporate espionage trojans out there for every one we hear about. Scary.
Is this really considered a 0 day anymore? I mean...its a 0 day exploit on day 0. We are kind of past that now aren't we?
The only change I can believe in is what I find in my couch cushions.
I'd probably put this in the "trustworty" bin...
:P
However, if it was spelled properly, then I'd raise an alarm
how long until
AMEN
Just astounded what would people do just so that they won't have to work with the Linux/OSS nightmare...
"Symantec's Huger said the sophisticated nature of the attacks suggest it is the work or well-organized criminals associated with industrial espionage."
Fortunately Symantec is coming up with several ways to protect and save us from this nefarious criminal underground. Sorry Symantec, but my suspicion alert level is glowing bright red.
I don't recall the last time my machine was infected by software that another piece of software could actually do something about it (e.g. virus, trojan, etc). Mostly its just spyware and rootkits that I don't even know are there until my machine starts running really slow. In spite of this, I've been running some sort of AV application on every system I own for the last 5+ years (basically since I plugged into an always on, broadband connection). The other day I began wondering how much power the aggregate compute cycles for my systems has consumed simply loading the AV software and doing whatever scans are necessary. Then I began wondering about this for all machines everywhere. Besides reduced power bills, what benefit could be derived from diverting all those wasted cycles to a task of tangible benefit?
Of course the other side of this argument points to the eradication of polio from a long-term vaccination regimen and resurgence in places where vaccination isn't occurring.
In any case, it tickles some nerve deep in my brain when I realize that the folks that are screaming loudest about computer security are also those who stand to benefit most by hocking their wares.
Anyone with an IQ above that of a cabbage, perhaps?
20 January 2017: the End of an Error.
Is this trojan a problem for the OOo program Impress?
Anyone with an IQ above that of a cabbage, perhaps?
http://en.wikipedia.org/wiki/Al_Gore
Mod me down with all of your hatred and your journey towards the dark side will be complete!
assa
One of my customers uses PowerPoint quite frequently. He draws up charts and graphs during meetings and emails the notes to everyone in attendance.
What to do?
During the tests the British Challenger tanks had difficulty with navigation and were unable to work out exactly where they were. The British use the satellite global positioning system, GPS, for navigation, whilst the French had no such problems with their navigation.
The Americans also claimed that their navigation suffered difficulty and it was later alleged that the French were covertly interfering with a GPS signal.
Would you buy a tank whose GPS navigation can be interfered with by the French?
Have you ever actually looked at microsoft's response times. There are many viruses that use the same doors to damage system, and the reason for it?
Slow response times. This is microsoft's way, it can't just be a hot fix, it has to be a hotfix, say three days to write, then testing begins, doesn't fix the problem on one computer, another week of programming, then finally it's ready for more testing. You get the idea.
With the continuing risk that Office and Windows represents, what company really, really, really needs to have Windows and Office anymore? The last few exploits are carefully crafted to hide themselves, capture sensitive corporate information and, essentially, ruin specific company targets.
Frankly, any company that really, really, really needs to have Microsoft products is going to be out of business soon anyway!
America's government is notorious for economic espionage and many of its corporations, probably most, are controlled/owned by military officers or the military as an organization. The fears about America are grounded in reality.
Oh, wait, did I copy that wrong? I was just thining about all the silly IP laws the USA tries to export and companies like Lockheed Martin, General Dynamics, Diebold, Blackwater, Haliburton...
It sends the stolen information to a computer in China?
Does this mean if you make sure your slides all have the magic word in white on white in them somewhere, they'll get gobbled by the People's Great Firewall and the perps won't get your data?
Squirrel!
I asked a few folks I work with back when the last (actually, the last before the last, the Word 0-day) exploit came out, whether it was feasible in a corporate environment to configure servers to strip attachments from any email where the mail (and the attachment) are not signed by a recognizable, valid cert.
Obviously, this requires a PKI of some sort, but for those companies which already do, it seems this would be a simple, easy way to virtually eliminate the possibility of outside trojans / viruses / whatever getting loose in the internal environment.
In fact, it's so simple, that I'm sure I'm missing something significant. Anyone care to point out what it is?
If I were the China government and I wanted to carry out some industrial espionage, I will choose a server in India, Taiwan, or wherever not within my jurisdiction to relay the traffic. No one will be that stupid to use their own machine for serious operation, esp with this sort of sophisticated zero-date crack.
If you look up 8800.org (the one that the powerpoint crack sends keylog data to), you will know that it hosts free DNS forwarding service (excuse if my terminalogy is wrong). It provides the same sort of service as no-ip.com or dyndns.com. I can imagine the web traffic is forwarded to some cracked home machine with broadband connection. The real recipent behind this can really be anyone.
The financial stuff is great, even if only used as financial info. There is this thing called the stock market, where advance knowledge can be translated into a SHITLOAD of money...
Then, since this is the Chinese:
Purchase orders for submarine parts may reveal designs.
Ripping off Apple is easier if you know in advance.
Future hacking may be easier if you can swipe some source code.
A list of employees at a defense contractor helps with social engineering.
I can't get the trojan to run. That seems rather incompatible to me.
I guess I should file a bug report.
For all our new TOP SECRET programs, we must pick suitable codewords.
Transmit by DEMOCRACY channels only!
For FALUNG GONG usage only!
Authorized for TAIWAN program only!
Access restricted to FREE TIBET personnel only!