Slashdot Mirror
MS Office Zero-Day Under Attack
paulBarbs writes "Microsoft is warning users to be on the lookout for suspicious Excel files that arrive unexpectedly — even if they come from a co-worker's e-mail address. In an advisory, Microsoft confirmed a new wave of limited "zero-day" attacks was underway, using a code execution flaw in its Microsoft Office desktop productivity suite. Although .xls files are currently being used to launch the spear phishing attacks, Microsoft said users of other Office applications (Word, PowerPoint, Outlook, Access, etc.) are potentially at risk."
Dear Exploit,
How old are you? How long have you been available in the wild? How long did your brother exist in SP1 before you came along in SP2? Do you have a cousin which works in Win98/SE? How long have corporate managers been using you to spy on their employees?
Signed,
Secret Admirer
the NPG electrode was replaced with carbon blac
How many more exploits will we need to encounter with Microsoft products before people realize that it's just not worth it to use such flawed software?
I would have thought that businesses would be the first to learn. They are the ones who tend to be the most affected by situations like this, especially when hundreds or thousands of Windows-based computers on their internal networks become compromised. It costs them a lot of money to clean up those systems.
Of course, such expenditure could have been prevented in the first place were they using suitable office software. And that doesn't mean OpenOffice.org on Linux. There are many other alternatives, especially when using Mac OS X. Those alternatives can often exceed Microsoft's products in terms of quality, usability, features and security.
MS Office Zero-Day Under Attack
*rereads headline* what?
Push Button, Receive Bacon
to protect myself against 0-day attacks.
The fact that this does not affect Office 2007 suggests that Microsoft is learning from their mistakes.
This is further supported by other software they have released that went throught their "secure development lifecycle" initiative, including IIS 6.0, IIS 7.0, Windows Vista, Windows Server 2003, etc.
Of course, IIS 7 and Vista have only been out there for a few months now... so, obviously, the jury is still out on them.
The moral of the story is: If everyone else jumped off a cliff, why yes, we would jump too.
It's an unfortunate but inescapable aspect of human societies that we value conformity above our individual safety.
Crumb's Corollary: Never bring a knife to a bun fight.
Maybe this is related to Bill Gates' recent comments, saying he dares someone to do to Microsoft what has recently happened with OS X and zero-days. Careful what you wish for. http://apple.slashdot.org/article.pl?sid=07/02/02/ 1940232
Vic
Lately we've seen memos and emails suggesting just how far MS is willing to go, perhaps in the future we'll see emails or memos describing how malicious software was released into the wild to help people decide to buy the new 2007 applications to go with their new Vista PCs?
Support NYCountryLawyer RIAA vs People
It's an unfortunate but inescapable aspect of human societies that we value conformity above our individual safety. you missed the moral, friend. The moral is that we value our ability to conduct business above our individual safety.
I am so glad I switched to open office. Now whenever one of these things happens I send the article to my friends along with a link for OpenOffice
It's only paranoia if your wrong...
> So, my question is, who's doing it right and how ?
Code has become so enormous that the answer is, more than likely, nobody.
I'm still puzzled. Spreadsheet programs, word processors, database programs, etc. etc. etc. all fit on one, maybe two, floppy disks at one time. If anyone wonders how to write secure code the largest starting point is: cut out the advertising glitz and cruft.
But then the rest of the population would happily go back to sticky notes, $2.99 calculators, pencils, the telephone, US Mail, and the kitchen table (for solitaire) and that wouldn't be profitable for the market sector. So, love it or hate it, just view the security industry not as a problem to be solved but as a tiger to be fed and groomed.
the NPG electrode was replaced with carbon blac
Deleted
That's odd - the advisory suggests that Mac Office v.x and 2004 are vulnerable, but that certainly doesn't chime with the mechanism quoted. What's going on here?
... look how pretty Ribbon is!
Yeah, cause we know that pyramid schemes and MLM require each and every recipient to join the game. If only 50 % of the population used Office, but each infected machine sent out two copies (and each was opened), we would have a steady state of fresh infections. Logic like yours might have worked when the primary vector was the actual work documents, or floppy disks. With mass mailings, even a very small fraction could ensure a significant outreach. The question is simply if the explosive phase will be delayed enough to put extra countermeasures into place.
If you follow that logic, anything not open source is open to that vulnerability, Microsoft or not...
However, if you actually try the code which does impact Office 2003 and earlier additions, it does NOT work. Makes me glad I got my free copy of Office 2007.
I fail to see why posts talking about vulnerabilities in widely used software is tagged "haha". Is it really so funny?
The zombies that will result from those attacks will send spam even to your tricked out Linux PC. You're laughing at your own expense. Have fun.
If only there were a single, well defined and completely open document format that could be used by anyone, with any office suite. That would be just great.
455fe10422ca29c4933f95052b792ab2
MS wrote loads of stuff with C++ and the C stings library especially, is total crap. Also, with C++, it is fundamentally impossible to know when it is safe to destroy an object and free its memory. MS is therefore suffering from a bad choice of compiler and coding methods years ago. Their problems won't go away anytime soon.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I say we just put up with the problems in Windows.
Windows just needs time to mature.
At the moment Microsoft are undergoing a big shake up.
Everyone has their foibles, and Windows is no different.
No software is perfect.
Microsoft are really trying to turn things around.
I also don't have to worry about the vendor shutting down my OS or apps remotely in the future.
Hi. I'm a PC user, with an HP laptop, and Office 2007. Not too long ago I had Vista Beta on this thing. And you know what? I don't have to worry about the vendor shutting me down ever. You know why? Because I live in a country that follows the rule of law, and can prove in a court that I purchased these things legally.
Part of me wishes they'd try -- it's amazing how good the upgrade from "punative damages" would be.
You can also avoid the attack by setting %TEMP% to no execute permissions. Interesting that they don't say that.
My Word 2007 allows me to save in the new Word format, Word 1997 - 2003 (which allows reading things TEN years older, not 3 as you have said), PDF, XPS (which I don't know why I'd use), .txt, RTF, HTML, and a few others..
Why spread this FUD?
Hate Microsoft because of legitimate reasons (like anti-trust), NOT for reasons made up, like a little girl.
For Christmas I bought a system from CSS.
Did you get an employee discount?
Don't become a regular here -- you will become retarded.
Bill Gates is a great man, he is giving all his money away to charity.
Without Microsoft computers would be much harder to use and more expensive.
Etc.
I wasn't so much trying to be funny as regurgitating some of the sugar-coated bullshit I've been spoon-fed by the media over the past couple of years leading up to the release of Vista.
My honest opinion from what I've seen of Bill Gates is that he seems very insincere most of the time, like he is trying to hide deep seated insecurities behind a veneer of smugness. I suspect he is really fixated on how people perceive him.
Continuing in the amateur psychology vein, I think that his deep seated insecurities shaped Microsoft and guided it's behavior.
Would a company that was proud of it's creations feel that they had to constantly intimidate hardware partners in order to ensure they keep using that software, or specifically adjust their software to make it incompatible with competing software?
Personally I think those are the actions of a company that believes that their customers, given a choice, would rather migrate away.
Comment removed based on user account deletion
I don't have to worry about the vendor shutting me down ever. You know why? Because I live in a country that follows the rule of law, and can prove in a court that I purchased these things legally.
So your solution is that we keep receipts of every single thing we purchase because the burden is upon us, the consumers, to prove that everything we have purchased is legal?
Gee, that sounds like a wonderful solution. "Why are you so worried about the government mandating cameras in your house? Surely, if you're not a criminal, you have nothing to hide!"
And I really mean it - if enough people do that (and manage to actually win the case), maybe MS will reconsider its policy of "stop the pirates, no matter how many legitimate users get caught in the middle".
Assorted stuff I do sometimes: Lemuria.org
Unfortunately a lot of installers seem to extract themself to %temp% and then run one of the extracted files to continue, so this isn't a permanent solution. Unless you're not ever going to install anything that is.