Slashdot Mirror
MS Office Zero-Day Under Attack
paulBarbs writes "Microsoft is warning users to be on the lookout for suspicious Excel files that arrive unexpectedly — even if they come from a co-worker's e-mail address. In an advisory, Microsoft confirmed a new wave of limited "zero-day" attacks was underway, using a code execution flaw in its Microsoft Office desktop productivity suite. Although .xls files are currently being used to launch the spear phishing attacks, Microsoft said users of other Office applications (Word, PowerPoint, Outlook, Access, etc.) are potentially at risk."
Dear Exploit,
How old are you? How long have you been available in the wild? How long did your brother exist in SP1 before you came along in SP2? Do you have a cousin which works in Win98/SE? How long have corporate managers been using you to spy on their employees?
Signed,
Secret Admirer
the NPG electrode was replaced with carbon blac
How many more exploits will we need to encounter with Microsoft products before people realize that it's just not worth it to use such flawed software?
I would have thought that businesses would be the first to learn. They are the ones who tend to be the most affected by situations like this, especially when hundreds or thousands of Windows-based computers on their internal networks become compromised. It costs them a lot of money to clean up those systems.
Of course, such expenditure could have been prevented in the first place were they using suitable office software. And that doesn't mean OpenOffice.org on Linux. There are many other alternatives, especially when using Mac OS X. Those alternatives can often exceed Microsoft's products in terms of quality, usability, features and security.
MS Office Zero-Day Under Attack
*rereads headline* what?
Push Button, Receive Bacon
to protect myself against 0-day attacks.
businesses need to be able to share documents with their business partners and clients, thusly, they must support the same file formats as their business partners and clients.
The fact that this does not affect Office 2007 suggests that Microsoft is learning from their mistakes.
This is further supported by other software they have released that went throught their "secure development lifecycle" initiative, including IIS 6.0, IIS 7.0, Windows Vista, Windows Server 2003, etc.
Of course, IIS 7 and Vista have only been out there for a few months now... so, obviously, the jury is still out on them.
After all these years, the same software bugs seem to continually crop up. I guess that no currently available platform is safe but can't we do better? It has been 2 decades of worrying about viruses, worms,trojans, format string errors, buffer overflows, etc. Microsoft was a latecomer to the "make software secure" game but it has been about 5 years now and the song remains the same. So, my question is, who's doing it right and how ?
Pain is merely failure leaving the body
I'll open the XLS file in OpenOffice. I use Linux anyway :) Len
Maybe this is related to Bill Gates' recent comments, saying he dares someone to do to Microsoft what has recently happened with OS X and zero-days. Careful what you wish for. http://apple.slashdot.org/article.pl?sid=07/02/02/ 1940232
Vic
I'm shocked that Billy Joel needed a vocoder to perform the national anthem at the superbowl
They're using their grammar skills there.
Lately we've seen memos and emails suggesting just how far MS is willing to go, perhaps in the future we'll see emails or memos describing how malicious software was released into the wild to help people decide to buy the new 2007 applications to go with their new Vista PCs?
Support NYCountryLawyer RIAA vs People
Do we know for sure that Office 2007 is not affected? Without the source code being available to us under an open source license, I don't think we can, as a community, safely say that it is not affected. All we can do is speculate, or blindly trust Microsoft if they say it's not affected.
I am so glad I switched to open office. Now whenever one of these things happens I send the article to my friends along with a link for OpenOffice
It's only paranoia if your wrong...
who thought of the grunt voice from Warcraft II when they read the headline.
Monstar L
Again it isn't just Microsoft windows that is the problem.
For Christmas I bought a system from CSS.
http://www.curtissystemssoftware.com/preloads.htm
It came preloaded with a OpenOffice.org. Has quality hardware (unlike a Dell which has the lowest bidder components). Even had ECC memory
Even with out anti-virus software it is immune to all this crap. I also don't have to worry about the vendor shutting down my OS or apps remotely in the future.
What would be the chance of successful propagation?
1st transmission: 100%
2nd: 50%
3rd: 25%
4th: 12%
5th: 6%
As you can see, the chance of successfully propagating beyond the current system drops off rapidly. It's the fact that so many people out there choose to run Microsoft Office that viruses and trojans can propagate so easily. If there were several different but compatible office suites which could share the same file formats we wouldn't have nearly the problem we have with security.
Deleted
Deleted
That's odd - the advisory suggests that Mac Office v.x and 2004 are vulnerable, but that certainly doesn't chime with the mechanism quoted. What's going on here?
Why does that letter sound like it was written by a child abuser?
... look how pretty Ribbon is!
I was going to suggest a Month Of Office Bugs to the lists, but the only way I can see it working is if we have 8 bugs a day for a year...
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
Because if enough trolls all hide on the internet and point in one direction then the people who don't know any better will mob in that direction.
Someone should log your IP and prosecute you.
I fail to see why posts talking about vulnerabilities in widely used software is tagged "haha". Is it really so funny?
The zombies that will result from those attacks will send spam even to your tricked out Linux PC. You're laughing at your own expense. Have fun.
They're not "zero days" unless the exploits are released/in the wild before the product is available to consumers, but after the manufacturer can do anything about it. If these were security issues with MS Office 2007 and Office remained vulnerable when released, they'd be zero days. But these are vulnerabilities in software that's been out for years, including Office 2000!
We can't just throw the phrase around like this; it has a real and verifiable meaning.
eComStation and OpenOffice.org is the cure I use.
eComStation is more stable than windows but a lot easier than Linux
For Christmas I bought a system from CSS.
http://www.curtissystemssoftware.com/preloads.htm
It came preloaded with a OpenOffice.org. Has quality hardware (instead of the Dell's lowest bidder components). Even had ECC memory.
Even with out anti-virus software it is immune to all this crap. I also don't have to worry about the vendor shutting down my OS or apps remotely in the future.
Seems kinda suspicious to me that the only way to avoid this attack it to upgrade to the latest piece of software. This means their Office 2007 sales are low. You'd think they could just release a patch instead of being so money grubbing.
Communism, its a party!
...a day goes by when Office and Windows are not exploited with trivial ease.
we will end no whine before its time
Shouldn't the businesses be more worried about THEIR intellectuual property rather than microsoft's. The words typed and spreadsheets, presentations the employees create is owned by the business. Seems like the tool, microsoft office gets more protection than the work results created.
All documents should be in open file formats.
http://openoffice.org/
It is your PC
Your thoughts expressed in documents, spreadsheets, drawing, etc should be primary. The proprietary document computer file formats should not be used to lock you out of YOUR intellectuual property. Microsoft proprietary document Word/Office (.doc) and Excel (.xls) force you to pay an upgrade ransom to keep using or sharing YOUR intellectual property.
http://lists.ufl.edu/cgi-bin/wa?A2=ind0510&L=ccc&
Subject: Introduction to OpenDocument
Date: Thu, 20 Oct 2005
From: Ken Sallot
Get virus resistant computer preloaded with OpenOffice
http://www.curtissystemssoftware.com/preloads.htm
Sorry to ruin your delusions of grandeur, but its got nothing to do with conformity. Its to do with *being able to share documents with your business partners*. Why are you slashbots so insecure that you always need to put people down like this? I suppose if in real life you're always the victim and never have the courage to stand up to anyone you need somewhere to vent, eh?
I say we just put up with the problems in Windows.
Windows just needs time to mature.
At the moment Microsoft are undergoing a big shake up.
Everyone has their foibles, and Windows is no different.
No software is perfect.
Microsoft are really trying to turn things around.
Wow. People are still using OS/2 and its derivatives? Not only still using it, but switching to it? I haven't heard anything from OS/2 zealots in a long time.
Every time you post an article on Slashdot, I kill a server. Think of the servers!
I also don't have to worry about the vendor shutting down my OS or apps remotely in the future.
Hi. I'm a PC user, with an HP laptop, and Office 2007. Not too long ago I had Vista Beta on this thing. And you know what? I don't have to worry about the vendor shutting me down ever. You know why? Because I live in a country that follows the rule of law, and can prove in a court that I purchased these things legally.
Part of me wishes they'd try -- it's amazing how good the upgrade from "punative damages" would be.
You're trying to be funny, right? Sweet Jesus, no one in their right mind would call Windows a product that enables its users to excel. I had to talk with Gates several times in the 80's and my impression has always been that he's a shit who makes middlebrowwear. Now he's a mega-billionare little shit who makes slightly more functional middlebrowware. Fucking sharky little dick is ol' Billy. Glad I'm out of that crappy business: pushing shit Microsoft software.
VERY few image formats are allowed by the specification to contain arbitrary code...
(The other times you hear it happening, someone has managed to find a buffer overrun, the executable bit isn't part of the image format itself.)
If they didn't have bugs like this... no one would need to buy Office 2007.
Especially after that interview with Bill Gates in Newsweek. It's not that people don't feel for Microsoft's victims. It's just that when you make the claims Gates did you have to be able to back them up. Time and time again Microsoft has shown that they can't.
The thing about MS products is they sell very well (for various reasons), and each new version requires more horsepower. This makes hardware manufacturers very happy to support Windows. Eager, in fact. How many products did you see that had "Vista Ready" proudly displayed months before Vista was officially released...?
It's all part of the money-go-round. Microsoft effectively markets bloated software, which feeds sales to the hardware industry, and sales to retail outlets. To return the favour, the hardware manufacturers work furiously to support Windows in promises of greater income.
No wonder hardware manufacturers are not keen on supporting Linux. OSS users do their best to run Linux on hardware they *already* own. This doesn't push sales.
I mean, look at DirectX10. It's a sales tools for both Vista *and* hardware. It's a great business model, from a consumerist society stand point. Linux, and in many ways OSX, fails in this way.
Why was it decided that Office documents could be loaded with scripts that would have the power to manipulate (or delete) files on a hard disk? I'm not an expert on viruses, and I might not have a full understanding of how these exploits work, but it seems to me that most of these problems arise because MS products are given way too much control over a user's computer. Why can't we go back to the days where a document was just that--a document, containing nothing but data and basic functions to display that data within the appropriate Office application? I know MS are just trying to give the end user maximum flexibility, but I think they've gone too far. I don't know of a single legitimate reason for why someone would like their Word document to delete files on their drive when it's opened, or send data over the internet. And why doesn't Office display a message whenever a document tries to do something that could be seen as destructive? "Warning: This document is attempting to delete the following file. Are you sure you want to allow this?" That would still work for legitimate files, as the user would simply click "Yes" and everything works as intended.
Throw ActiveX into a lake, and take VB Script out of office documents. These things are simply unnecessary.
Could you tell those CSS folks that Geocities called and they want their website back? Thanks.
All I got was a boring multi-tabbed document with some financial info. I thought someone just sent it to me by mistake.
OpenOffice just opened it, no harm done.
For Christmas I bought a system from CSS.
Did you get an employee discount?
Don't become a regular here -- you will become retarded.
Bill Gates is a great man, he is giving all his money away to charity.
Without Microsoft computers would be much harder to use and more expensive.
Etc.
I wasn't so much trying to be funny as regurgitating some of the sugar-coated bullshit I've been spoon-fed by the media over the past couple of years leading up to the release of Vista.
My honest opinion from what I've seen of Bill Gates is that he seems very insincere most of the time, like he is trying to hide deep seated insecurities behind a veneer of smugness. I suspect he is really fixated on how people perceive him.
Continuing in the amateur psychology vein, I think that his deep seated insecurities shaped Microsoft and guided it's behavior.
Would a company that was proud of it's creations feel that they had to constantly intimidate hardware partners in order to ensure they keep using that software, or specifically adjust their software to make it incompatible with competing software?
Personally I think those are the actions of a company that believes that their customers, given a choice, would rather migrate away.
lol
Comment removed based on user account deletion
I don't have to worry about the vendor shutting me down ever. You know why? Because I live in a country that follows the rule of law, and can prove in a court that I purchased these things legally.
So your solution is that we keep receipts of every single thing we purchase because the burden is upon us, the consumers, to prove that everything we have purchased is legal?
Gee, that sounds like a wonderful solution. "Why are you so worried about the government mandating cameras in your house? Surely, if you're not a criminal, you have nothing to hide!"
And I really mean it - if enough people do that (and manage to actually win the case), maybe MS will reconsider its policy of "stop the pirates, no matter how many legitimate users get caught in the middle".
once you start taking stuff out you are potentially opening up code paths that have minimal coverage/testing... this is not a recipe for stable or secure software.
Yes. Because if the onus were upon the corporation, could you trust them not to do what is in their favor already?
The point isn't whether it's ethical for them to say "Oops, we lost your receipt." or not, the point is, there's a reason that every time you purchase something, you are handed a receipt. It's an unwritten rule that the receipt is an agreement between you and the company. The company is explaining to you that you will bare the burden of proof of ownership, because their product is sold in many stores, and privacy agreements often keep them from even acquiring evidence of your ownership via purchase at some other place. Or in the case of buying goods or services directly, the company is establishing an agreement on the goods or services exchanged. It allows them to defend themselves if you accuse them of unfairly charging, and it allows you to defend yourself in the same situation.
Nevertheless, if you dare imagine a world in which the onus is entirely upon the corporation and that the consumer never saw a receipt... oh, that's a scary world indeed. -- Upon finding one's bank statements, one might exclaim, "What the hell is this $5000 charge for blinker fluid?"
"So your solution is that we keep receipts of every single thing we purchase because the burden is upon us, the consumers, to prove that everything we have purchased is legal?"
No - just for the expensive stuff. I certainly do - I don't expect them to repair my LCD TV out of the goodness of their hearts if it breaks, etc. Validation failure in Vista seems even less likely than my TV giving up.
I should add I presently run XP Corp PE (Pirate Edition). Works like a charm, but I won't pretend to get all morally indignated if MS found some way of shutting me down.
Assorted stuff I do sometimes: Lemuria.org
1. Users seem unwilling to upgrade office
2. Publish previously "unknown" exploits for old office programs
3. ?????
4. Profit!
It's Day 5 and I can't find anything referencing how much of this is getting around on http://www.virus-radar.com/. Sure, it's not the most important characteristic, but anyone seen it?
What you have to consider when looking at charitable donations is:
How much is actual cash, and how much is given away as products (remember microsoft's products cost them virtually nothing to reproduce).
What kick-back do they get in the form of tax breaks? (when donating products, assuming the tax break is based on the retail cost, they can still make huge profits purely from that because the reproduction cost is so minimal).
How much is the PR worth? Donating to charity is simply a form of marketing, how cost effective is it compared to other forms of marketing?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I work for a large company that probably spends several tens of millions of dollars a year over and above the green dollar cost for the licenses just downloading and installing patches and fixes for an endless series of 'maybe' threats in Windows. The problem is that with all of these fixes you can't really know which are real and which are theoretical and which can be ignored and which can be mitigated some other way. We just mooooove! along like cattle installing one patch after another wasting time and money. But what if people, say end users just said "screw it Redmond" What if we made THEM the bad guys and showed them and everyone else the results of us not doing THEIR jobs for them? How screwed up would the net become? How much would just stop running? And then we could go back to Redmond and point this out, saying "Hey this is what happens when we get sick of putting up with your crap. Now feel free to fix this or let it all crash in flames. Your choice, but in either case if you want the customers you've been screwing for 27 years to contine to work for you for free - well that's not going to happen. Sorry.
Couldn't the onus be on the accuser to say, I don't know, prove that their accusation? Something like innocent until proven guilty? I know it's novel concept but we could, in fact, just assume that people are acting within the law until they demonstrate otherwise. Yes, people could use that assumption to do bad things, but it also lets people who aren't doing bad things get on with their lives without inteference.
The company is explaining to you that you will bare the burden of proof of ownership
That's pattently ridiculous. They aren't explaining anything, nor are you entering any sort of agreement with them, written or otherwise, they're just documenting the transaction. I don't need the receipt to prove ownership, and depending on the specificity and verifiable authenticity of the receipt, it may not even be very useful to that effect.
Take for example a reciept that says "Jan 14: Company A: Services Rendered: $98.00: Cash Tendered: $98.00". Being in possetion of such a document is not proof of any of the following: 1) That any services were rendered, 2) that you recieved any services if they were rendered, 3) that you paid $98.00. There's some evidence that there was an agreement to render services and that someone gave Company A $98.00, but there's no evidence of your involvement, or that the services specified were actually rendered. In such a case a work log from Company A that shows an that an employee was dispatched to render services is probably much better evidence than the receipt. Likewise your personally accounting statements (self-generated or otherwise) may be more useful in proving that you personally rendered payment.
In any case, handing me a reciept is not sufficient cause for you to challenge my ownership of anything, nor is my failure to retain that receipt sufficient evidence that I am not the owner.
You have made 11 posts so far, and EVERY SINGLE ONE is an ad for the E-com Station business that sells computers.
In the past 24 hours, you made FOUR posts, all within TWO HOURS of each other. They were all ALL ads for E-com Station. Other than those four posts, there was nothing else for the past year-and-a-half.
Prior to that, two years ago you made FIVE posts, all within ONE HOUR of each other. They ALL advertised E-com Station.
There were two posts prior to that. Guess what they ALL advertised?
No, it's not illegal. No, I'm not going to sue you. But you'll pardon me if I take your posts with a heavy dose of sodium chloride.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
this topic is not something new for microsoft. they always come up with new things and there always way for people to put something in. I think they need to work hard on security issue. :)