Slashdot Mirror
Word Vulnerability Compromised US State Dept.
hf256 writes "Apparently hackers using an undisclosed (at the time) vulnerability compromised the State Departments network using a Word document sent as an email attachment. Investigators found multiple instances of infection, informed Microsoft, then had to sever internet connectivity to avoid leaking too much data!"
It seems those hackers missed the Philippines and accidentally hit the state department instead
The fact that a simple Word document can cause such a big problem is really sad. How can you tell a few thousand of people not to open word document attachment? I mean, where I work, users receive tons of documents (pdf, office, autocad) files by email from vendors and such, I guess the only defense is good email filtering but still a 0-day attack would make that useless.
At first, the hackers did not immediately appear to try stealing any U.S. government data. Authorities quietly monitored the hackers' activity, then tripwires severed Internet connections
If you find evidence of a break-in, its possible the attackers are also connecting in a way you haven't yet detected. Hope they know what they're doing. Given their reputation, I doubt it.
It would be so easy to just install StarOffice on each computer (keep Word), and ask the more technical departments to start using it, if only to save docs in Word format at first. I did this with the last company I worked at, nobody ever even complained. The cost was very minimal, and it actually saved a lot of money and time when an excel file corrupted itself. MS could not open it, but SO opened then re-saved it in MS format, then it worked fine.
Emacs
*ducks and runs*
Crumb's Corollary: Never bring a knife to a bun fight.
...knowing that your products were banned from the State Department for some theoretical and highly unlikely exploit, while Microsoft Word continues to be used there despite a documented (no pun intended) security breach attributed to it.
g) Cue the Grammar Nazi that points out the difference between "cue" and "queue" :)
I heard the install was faster/easier, and it was. You're right about the support - never tried it, but I did want to contribute to the open source concept, and $ rules the world. I knew those above me wouldn't notice an extra $20 on each pc, but they were scared of 'non-professional software', so to be able to tell them there was support was a necessary safeguard.
Oh, btw, they were using that excel sheet to keep track of a fleet of buses (this co was archaic in their IT dept when I got there). A radio dispatcher was frantically telling the bus drivers there was a computer problem and to 'hold tight' for 15 minutes till I got there, then 5-10 more minutes to figure out MS file recovery wouldnt cut it, and 5 to install SO from network and fix the prob. The only serious occasion that pitted MS vs SO and the results were stark. So no Im not on Sun's payroll, but the story ought to be a commercial, and I walked out like a hero so I'm happy to tell it.
> With open software, you can look at the source code and see exactly what it does
I though even the OS community had realised by now how ridiculous this argument is. World economy would in effect come to a halt if every company and public office started to scan source codes for potential vulnerabilities. This is hardly a selling argument and being a wise-ass about it has never helped the OS movement.
Having a goal of zero vulnerabilities is such complex software as an office suite is strikes as feasible only to an ideologist nerd. In practise there will always be vulnerabilities as long as human beings will be responsible for the design and programming. And having gazillions of eyes searching through the source code presumably on the company dollar is not effective way to remove those faults.
(This sig intentionally left blank)
Parent is making a valid point, and is not a troll, whoever modded them that way. The 'more eyes' argument doesn't really work for me either. I use open source software all the time, and I rarely have a look at the source code, and even less frequently take the trouble to understand even a small part of it.
What does work for me with open source is that the nature of open, distributed development tends to promote code modularity, which helps keep those defect counts down. And the fact that code is publicly available exerts an influence on developers to publish code they aren't be ashamed of (unlike what happens in proprietary software development with tight deadlines set by the sales team making unrealistic promises to clients - I have been there).
However, there is a real distinction between defect-free software (probably does not exist) and software that intentionally includes back-doors. With open-source, you can have more confidence that there is no back door, spy-ware, or anything else that shouldn't be part of the application. But it certainly doesn't mean the software will be defect free.