Slashdot Mirror
Microsoft Warns of PowerPoint Attack
narramissic writes to let us know about yet another PowerPoint flaw, this one affecting PowerPoint 2000, 2002, and 2003, soon after Microsoft issued a record number of patches to fix numerous Office vulnerabilities (among others). The new problem came to light in a blog posting by Microsoft Security Program Manager Alexandra Huft, but the coverage at ITWorld has more detail. Huft writes, "We've been made aware of proof of concept code published publicly affecting Microsoft Office 2003 PowerPoint," and goes on to say that Microsoft is not aware of any attacks that exploit the bug.
I don't use PowerPoint. When I go to a meeting, which is often, I immediately leave the room if someone decides to bore me with stupid phrases in 12-centimetre type. I am an intelligent man and I demand an intelligent medium by which to be educated.
I open and create all of my presentations in either Open Office or Star Office. So I don't see and issues for me. I don't do anything esoteric, so I have never had a MS Office user have a problem with my presentations.
"He's lost in a 'floyd hole"
That has got to be one of the funniest headlines I've seen in a LOOOONG time.
Stock up on milk and bread! Get out the hand-crank radio! The autoshapes are approaching fast! Run! For the love of God, RUN!!!!!!!!!!!!!!
I left my wallet in El Sigundo!
Well, if nothing else, college classes would get a little more interesting if the prefessor's slideshow suddenly turned into a stag reel...
There is no mod option "-1: Disagree" for a reason. "Overrated" is not an acceptable substitute. Post something instead.
All hell is going to break loose.
I wonder if this exploit is a problem for previous office versions?
(hope not, my 2000 works nicely)
liqbase
... I've seen plenty of presentations where the content has been so obscured by all the bells and whistles the user has added. While they're fixing the bug, maybe Microsoft can add a 'View Presentation in Minimalist Mode' option to Powerpoint.
Yes, I know, but I'd rather spend cash on something else and only really use powerpoint for viewing "amusing" presentations sent by email.
When I was an intern at a company that was in a competition with other companies to get business from lockheed they sent out a CD with power point slides on it that showed how our company rated against other companies. They had "scrubbed" the presentation so that we didn't know who anyone was except for our own company. There were many Excel graphs in the slides. It turns out that not only were the graphs embedded in the slides but the entire spreadsheets to make them were too. This allowed me to find the code to un-scramble which companies were which. I am not sure if this was/still is an "exploit", but at least something that every one should be aware of.
GENERATION 27: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
It looks like you're trying to close Powerpoint. Would you like me to kill you now?
NOOOOO!!1
BANG! BANG! BANG!
It looks like you're dead. Would you like help in calling the mortician?
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Flip Chart?, Chalk board?, Shadow Puppets?
Not to be mean, but Powerpoint is merely a tool purpose-designed for doing presentations. It is quite possible to write a good presentation in Poser-poi...er...Powerpoint, it just can't compensate for a bad presenter.
I like OpenOffice Impress as well BTW.
A goal is a dream with a deadline
Now I'm scared and it's not even Halloween yet!
Of course, back in my day it was overhead projectors and slide-show drums....but we've done that.
A goal is a dream with a deadline
I wonder, is the guy whose bright idea it was to come up with a fixed day for patching still working at MS?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What's with the sudden interest in security? If I didn't know better, I'd think you had a new OS release imminent:P
What gives?
That it had already been established that undisclosed PowerPoint & MS Office exploits are being used to commit corporate espionage?
[Fuck Beta]
o0t!
I think every presentation I've ever seen with flying graphics, pie charts, bullet points zooming in from the left, and all the other PowerPoint abuses a sales or marketing droid can think up in his voluminous spare time off the golf course, would definitely qualify as "PowerPoint Attacks".
It's a strange world -- let's keep it that way
I'm sure the I can speak for most of us when I say that we've already been experiencing power point attacks and they started right around the time our bosses took their first power point course and learned how to use^H^H^H abuse sound and animations.
"Look Lois, the two symbols of the Republican Party: an elephant, and a fat white guy who is threatened by change."
.. then invades all of the theatres showing "The Departed", "The Grudge 2", "Man of the Year", "Aquaman" and "Spiderman" to have the highest grossing box office weekend of all time.
PowerPoint is the preferred communication tool of the Idiocracy.
If knowledge of this vulnerability falls into the wrong hands (Kim Jong-Il, Fascist Moozlams, Treacherous Liberals, or the French) it could destroy Corporate America!
Fortunately, it can't destroy the White House. They draw all their ideas on big sheets of paper with crayons.
Rich And Stupid is not so bad as Working For Rich And Stupid.
And this is, I think, the first PC virus to attach into Meat Space, as it were.
The way this works is that a compromised Powerpoint presentation is played to a room-full a victims. The speaker is first affected, speaking in a very monotone voice, rapidly clicking through the compromised slides of bullet-points and pie-charts. Within 10 minutes, all the victims are asleep.
I swear. I've seen this happen!! NO URBAN LEGEND! Check SNOPES!!!!!!
If Nalgene water bottles are outlawed, only outlaws will have Nalgene water bottles.
http://www.norvig.com/Gettysburg/
OK, so everyone has alreay seen this...
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
That's why you see those folks who print out their presentations and pass them out. Besides, a lot of folks like it so they can make their own notes on them.
Your pitiful FlipChart-fu is no match for my mighty PowerPoint Attack!
Ceci n'est pas un post.
yesterday.
It was amazing, the guy just set it in motion and sat back down. Whole thing was animated, backgound music, transparent lettering that floated in front of the slides as they appeared. He never said a word, just let this thing run.
In the end, it was eye-candy but no substance. Being the smart-ass that I am, I made the comment to the guy sitting next to me (in a low and very dead-pan tone), "wow...he's got some mad powerpoint skills".
Ya know when you're in those situations where you have to be quiet?...and someone makes you laugh?....and you try to stifle that laugh only to have it come out as a snort, which is even worse?
Yea, I didn't make a friend that day...
A goal is a dream with a deadline
Microsoft Warns of PowerPoint Attack
We have these at work all the time. I call them "meetings"...
I make all my slide shows using XHTML. It sure takes a lot longer than PowerPoint, but it makes me feel all warm inside and that is all any of us are after.
[an error occurred while processing this sig]
It was Burlesque Shows :)
A goal is a dream with a deadline
Weren't they warned about this problem several months ago? Or is this yet another one???
Microsoft has this annoying policy of putting some kind of general purpose execution engine in every Office product, from Word to PowerPoint to IE. Documents don't have to be Turing-complete, people. In fact, they're more useful if they're purely declarative - you can repurpose the content.
(Postscript is the classic bad example. The Postscript model is explicitly an interpreter. As a result, it's difficult to do anything with a Postscript document other than print it in the specified format. Text extraction is tough. Reliable format conversion is very tough. Reliable conversion to a different screen size, which ought to be easy, is terribly hard. Everybody moved away from Postscript, even Adobe. Microsoft should have learned from this.)
You sure it's not this?
Sendou Wave Kick!!
I've been suffering PowerPoint attacks in morning meetings for years now.
What?
"The PowerPoints are coming!! The PowerPoints are coming!!"
I think she is working for mozilla now, maybe we will soon have a patch tuesday for firefox...
Got Code?
With all these patches that are now flooding windows users for both OS and other microsoft products. Microsoft has put so much effort into actually trying to roll out Vista, that they have committed a mistake only some small businesses are known for: Putting their eggs in one basket. They've let the obvious and numerous flaws from old operating systems stack up with no regard to fixing them save in massive updates, to find a way to push everyone involved in development and patching duties to focus on getting Vista ready for the open market. This is why now, after the announcement of pricing, the proposed features and system requirements, as well as migration costs, that many companies are now looking for other OS solution for future needs. I'm not saying Microsoft will be thrown away as the leading office system, but simply that they won't have the response they expect from customers once Vista has reached it's final retail (yet still incomplete) glory. But at least it make me feel a bit better that big companies can still make amateur mistakes...
They can sent out bartpe style live cd's
And we could call the sequel "The Return of the Revenge of the Son of Powerpoint: First Blood Part II." Eh, needs work.
This is not news.
I'm a network administrator and I've been noting (and every administrator on the planet too, I guess) that at least since april this year, in the days following patch tuesday (I call that "black friday") there is a new batch of exploits, and there are usually no MS exploits (the last month being an exception) until the next black friday.
Let's face it. If MS chooses a specific day to release al its patches of the month, it's logical that blackhats will choose a day that gives their exploits more bang for the buck.
Response time for MS if effectively 30 days (unless it happens to involve their DRM), and everybody knows it. Get used to it.
GPG 0x1B479C78
Currently: "The Microsoft Security Response Center works every day to help protect customers from vulnerabilities in software."
Should be: "The Microsoft Security Response Center works every day to help protect customers from vulnerabilities in our software.
Vista:XPSP2::ME:98SE
In Soviet Russia
gaudy Powerpoint presentations full of hype but no real meaning whatsoever
ATTACK YOU!
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The phrase PowerPoint attack causes me to think of a semi darkened room of people attending a business meeting. They have passed out on the seminar table, but they aren't dead, they are anesthetized.
In the land of the blind, the one-eyed man is king.
I've never used Powerpoint.
Stick Men
I mean, we see this "Microsoft 0day" story every week...
Is to buy a laser "pointer" from Wickedlasers.com and use it to try to burn a hole in anyone who attempts to present a powerpoint presentation to me. Note that this method can be defeated by painting your skin the same color as the laser, which is why it's important to have a couple of different colors on hand in case your presenter is a wiley one (I'm still working out what to do in the event of one wearing a mirrored fire suit...)
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I hear that Power Point is so feared because of its large store of ammunition, it has plenty of bullets.
Thanks folks I'll be here all week, and try the fish.
Quick raise the alert level to BSOD! It seems that KR is running out of scary material to keep Pavlov's people in line.
Postscript is the classic bad example. The Postscript model is explicitly an interpreter. As a result, it's difficult to do anything with a Postscript document other than print it in the specified format.
I might be wrong, but wasn't the whole point of PostScript to be for printing? I think in that respect it succeeded rather well. I wasn't meant to be converted to different formats or re-aspected (actually pure "size" conversion [scaling] works well because its not raster) or edited or anything else.
And PostScript is still pretty heavily used in decent printers. PDF certainly has some PS heritage.
What do you expect, Power Point is EVIL
http://lay-uh.ytmnd.com/
Powerpoint is good for those that generally don't know what they are talking about... but want to feel self important. Maybe they can't write, so they bullet and stand up. Maybe they are scared shit of putting in detail as then they would be discovered as BS experts.
Powerpoints is a political ego builder.
So if some corporate idiot stands up with a terse, non-detailed, non-specific influencing FUD, walk out isn't a bad thing to do. Successful managers do, game players stay. I want to see detail and comitment which counts a lot more than someone thinging aloud. and commitment comes from detail.
So - will Microsoft provide us with any defence against pointy sticks, then?
While true that PS is a Turing complete language, all those things you mention are specificly excluded from its goals. Its goal is to provide an exact method of printing something on paper. If you are trying to do something with a Postscript file and you are not either a Postscript printer, or Postscript displayer, then you are doing something outside of the spec.
The problem may be that people are using PS as a transmission-for-later-editing format, which it isnt.
Quick, post a load of off topic tosh to distract from the article. This place is getting as bad as UseNet with all the trolling. Does anyone here want to discuss how accessing data can allow the execution of arbitrary code on a machine.
davecb5620@gmail.com
Was this threat directed at the EU Commissioners?
Half Word - Will Double, Wire Palindrome, San Francisco