First OpenOffice Virus, Not In the Wild

NZheretic writes "According to APCmag, the first cross-platform OpenOffice.org virus — 'SB/Badbunny-A' — was emailed directly to Sophos from the virus developers. The proof-of-concept virus affects Windows, Mac OS X, and Linux systems and uses different methods on each. It has not yet been seen in the wild. Despite Sun's OpenOffice.org developer Malte Timmermann's claims to the contrary, this kind of embedded scripting attack represents a real threat to OpenOffice.org users. Back in June 2000 when Sun first announced the open sourcing of OpenOffice.org, the twelfth email to the open discussion list put forward a two-part solution for providing OpenOffice users with Safe(r) Scripting using restricted-mode execution by default and access by signed digital certificates. In October 2000 the issue of treating security as an 'add-on' feature rather than as a 'system property' was again raised. Is it time to now introduce such measures to the OpenOffice.org Core to greatly reduce any future risk from scripted infections?"

Comments

The real solution

[Rix]

Is to stop enabling scripting by default in software that has no real need of scripting. Hasn't even Microsoft learnt this by now?

Re:The real solution

[saibot834]

The real solution is to be careful wherever you can. Don't open email attachments of an unknown sender. Don't visit untrustworthy websites. Caution is still the best weapon against viruses.

Re:The real solution

[edizzles]

Even tought its a proof of concept, it's still baking on some idiot DL'ing and running it in OO, As with alot of todays big worms, the best deffense is the mouse and keybord and the mind of the end user. And yes i argee active X as a conspet has all but failed.

Re:The real solution

[Normal Dan]

The trouble with this solution is customers want things to just work. They do not want to have to mess with security settings. If all scripting is disabled, people will get frustrated and blame the program instead of the file, then use a different program.

I have seen this happen with web pages and FireFox. People complain that FireFox does not work with several web pages, when in reality, those web pages (which are tailored for IE) do not work with FireFox.

etc.

Re:The real solution

[truthsearch]

Ever work in a financial company? Some live almost entirely off of their scripted Excel spreadsheets. There is a lot of value in allowing spreadsheets to support scripting. But it's the abilities of those scripting languages that's a real problem. Just like JavaScript needs to be limited in scope within a web browser, so too should the spreadsheet scripts. Unfortunately these office suite scripts are often used for things like disk access to import data.

Re:The real solution

[CastrTroy]

I never really understood the need for scripting in an office application myself. I certainly think it causes more problems then it solves. And not just in the security aspects. It seems to me that the only things that result from scripting is security holes, and tying the user to the word processor, ala, we can't use OpenOffice, because we've programmed our entire business into MS Word macros, making it impossible to switch. Also, when scripting is provided, it should be sandboxed to ensure that nothing really bad happens. You don't need scripts that can open sockets in your word processor, or reading arbitrary files on the hard disk. Scripts should only have the ability to do things that the user would normally do with the application they are using.

Re:The real solution

[needacoolnickname]

What is an untrustworthy website?

Re:The real solution

[u-bend]

I dunno, doesn't call after the first date, doesn't stick up for you in a debate, cheats on you, and lies about it.

Re:The real solution

[radarsat1]

Unfortunately these office suite scripts are often used for things like disk access to import data.

And that, of course, is almost directly related to the fact that the MS file formats are closed. With an open format like ODF, scripts for importing data aren't critical, since it's quite easy instead for a program to export it in the proper format, or to write an external script or program to transform data into ODF format. After all, it's XML.

Unfortunately MS has trained industry to rely on scripting to do basic things that should be done in other ways, just for the sake of not having to divulge file format details.

But in any case, I agree with the opinion expressed elsewhere in the comments that scripting isn't inherently bad, but it should be limited in ability by default. If a company needs unprotected scripting so badly, I don't see why their IT department can't just deploy it with the correct defaults.

Re:The real solution

[Red Flayer]

As with alot of todays big worms, the best deffense is the mouse and keybord and the mind of the end user.

I'd contend that those are more often the worst defense. :)

Re:The real solution

[LiquidCoooled]

Don't open email attachments of an unknown sender

Many people get viruses (appearing to come) from well known trusted sources, so this advice is wrong.

The correct thing to say is:

Don't open unsolicited attachments or files, ever .

If in doubt, speak to the sender and confirm its validity.

Re:The real solution

[Anonymous Coward]

A untrustworthy website is a website that
- has content linked in (THAT would open a whole can of trust-this-trust-that now would it!)
- has bugs in web, app or db server.
- accepts malicious content including links to content
- you don't know if you can trust everyone with or who could get admin access to that server.

More or less. But it cant be that hard now can it, because I've heard of people making these decisions in realtime, while they surf.

Re:The real solution

[Anonymous Coward]

"Is to stop enabling scripting by default in software that has no real need of scripting. Hasn't even Microsoft learnt this by now?"

I agree; documents should not allow scripting; however, I have mix opinions about other applications IE: Excel. Creating 2 files; one for data and the other for scripting might be a partial solution. That would wind up being a pain to manage; however, how many office (ms / oo.o) users do use scripting? IMHO; not the average user; scripting is more of a power users trait.

PS: Please feel free to flame away. I guess there isn't an easy anwer.

Any thoughts?

Re:The real solution

[radarsat1]

Well that doesn't require scripting, now does it? Dumbass.

Re:The real solution

[morgan_greywolf]

A untrustworthy website is a website that
- has content linked in (THAT would open a whole can of trust-this-trust-that now would it!)
- has bugs in web, app or db server.
- accepts malicious content including links to content
- you don't know if you can trust everyone with or who could get admin access to that server.

Hmmm...this sounds familiar.

I think you just described Slashdot.

-- a really old /. user who remembers ALL the bugs in slash and MySQL that plagued this site.

Re:The real solution

[Dog-Cow]

You are an idiot. An Excel script that manipulates data from external sources isn't going to wait around for you to manually fill in a bunch of worksheet tabs. It's going to do the import on its own and massage the data according to the needs of the end-user. You wouldn't write a perl script that asks you to input thousands of lines of data from the terminal, would you? I'd hope you'd expect it to read from any files as necessary.

Yes, I know that STDIN can be one of the files, but that only works if the script only reads one file.

Re:The real solution

[fluffman86]

I really like McAfee SiteAdvisor to help me decide. It's available as a Firefox extension and turns green if a site is not known to have any bad downloads or send unwanted emails. It's gray if unknown, and red if a site has malicious downloads or sends out a lot of emails. It's by no means an excuse for not using your brain FIRST, but it helps sometimes.

Re:The real solution

[Anonymous Coward]

Clearly, the solution is for scripts to be able to have named input and output channels in addition to stdin/err/out: myfrob <foofile.txt &frob2<barfile.txt &Lemur<goofile.txt >myout.txt &myfrobout2>lemuria.txt

(Right now, unix "only" supports numbered file descriptors, and because ones >2 (0=stdin,1=stdout,2=stderr) may be dynamically allocated or fulfilling system-specific special purposes, it's difficult to guarantee they're available and do what you think they do without knowing internals)

Then scripts are only passed open file descriptors (i.e. capabilities!!! Yay capabilities!!!), and they can therefore be forbidden from calling open().

Re:The real solution

[EvilSS]

since it's quite easy instead for a program to export it in the proper format

This is also the case with MS Office. Microsoft provides COM interfaces to the office products that can be used to generate documents. I do this all the time with Excel. It is actually very simple to use and well documented.

Re:The real solution

[Tychon]

While I agree with the notion of having it turned off by default, I'd just like to quip a little on how scripting has saved my inedible bacon numerous times.

Government writing often has numerous specs and requirements for document content and layout, requirements that cannot easily be met by standard features and interface in Word/Writer. Scripting provides a simple means of getting around this without actually trying to manually fudge characters or list elements in five to ten thousand page documents.

You may feel like doing this by hand, I do not.

Re:The real solution

[Anonymous Coward]

"the best deffense is the mouse and keybord and the mind of the end user."

Of course you can't count on that, so it's time to try a different approach.

So, summarizing the article:

"Is it time to now introduce such measures to the OpenOffice.org Core to greatly reduce any future risk from scripted infections?"

Surely yes.

"Will it be done?"

Probably not.

"Will we see an explosion of OOo focused worms?"

Probably yes.

Re:The real solution

[zcat_NZ]

Just a reminder for those with short memories; the first Word virus (WM/Concept) was accidentally included in the Microsoft Windows 95 Software Compatibility Test CD and shipped to hundreds of OEMs.

Ref; http://www.sophos.com/security/analyses/wmconcept. html

No source is entirely 'safe'

Re:The real solution

[FKnight]

Unfortunately these office suite scripts are often used for things like disk access to import data.

And that, of course, is almost directly related to the fact that the MS file formats are closed. With an open format like ODF, scripts for importing data aren't critical, since it's quite easy instead for a program to export it in the proper format, or to write an external script or program to transform data into ODF format. After all, it's XML.

---- So you're saying XML based ODF format files are not stored on disk, right?

Re:The real solution

[roman_mir]

-- a really old /. user who remembers ALL the bugs in slash and MySQL that plagued this site. - said morgan_greywolf (835522)

Re:The real solution

[veganboyjosh]

If in doubt, speak to the sender and confirm its validity.
vbj: did you send me this file, and what is it?
mother in law: oh, it's this cute video of some cats...
vbj: ...

Re:The real solution

[ronanbear]

All or nothing script/macro access where your options are confined to on/off/ask are such an obvious problem I'm amazed that they're not taken more seriously.

I don't get why anyone (with the users interests at heart) would add office scripting functionality without adding some form of permissions. Maybe back in the days before networking it was practical because most files were created on the computer itself or came on a trusted disk.

It's not even an option to inspect macros on Office before opening the file (yes, I know you can disable, open, inspect (if it will let you), close, re-enable and open). Why would a user want to run unsigned code from an unknown source that can't be read and give it permission to control your computer.

OOo deserves a slagging for falling into the same trap because - aside from compatibility with Office - it has no excuses. And it would be different if this had been a Word script that also functioned on OOo. This is a ball dropped by the OOo team because it's one obvious area where OOo has been better than Office.

Re:The real solution

[morgan_greywolf]

My other account, which I no longer use, is *5* digits, young-un.

Re:The real solution

[morgan_greywolf]

Correction -- low 5-digits.

Re:The real solution

[Anonymous Coward]

You don't need scripts...reading arbitrary files on the hard disk. Scripts should only have the ability to do things that the user would normally do with the application they are using.

Dunno about you but I find I can read arbitrary files on my hard disk using a word processor; admittedly it does moan about the contents of some of them, but selecting plain, unformatted text usually deals with that.

Re:The real solution

[Anonymous Coward]

Using a spreadsheet with some run-of-the-mill engineering equations would be at best tough without the ability to write function macros.

For example, try solving in a cell for the pressure drop in ducts and pipes using
dPressure/Length = C * f * Velocity * Velocity,
where
C is a given constant
Velocity is calculated from the volumetric flow and cross section area,
f comes from the implicit equation:
1/sqrt(f) = -2*log(12*e/(3.7*Dh) + 2.51 /(Re * sqrt(f)))
where
Dh is the hydraulic diameter (if not circular it needs to be calculated from the dimensions)
e is a function of the material roughness divided by Dh
Re, the Reynolds number, is a function of viscosity, density, velocity, and diameter.

I have function macros for this and many other equations that make my life a heck of a lot easier than it would be without. Spreadsheets are useful because they allow quick answers for a lot of what-ifs in an easily saveable and printable format.

Don't throw out macros - confine them so they can't mess with arbitrary files and memory.

Re:The real solution

[Teun]

My other account, which I no longer use, is *5* digits, young-un.
Correction -- low 5-digits.
So old you can't remember the password...
No not the account, I mean you ;)

Re:The real solution

[Rastafario]

This must be one of the patents Microsoft claims is being infringed upon!

Re:The real solution

[gbjbaanb]

... and my other car is a Porsche...

Re:The real solution

[roman_mir]

pffft, my other account is 2 digits, but that doesn't stop me from not complaining.

Re:The real solution

[ozmanjusri]

"An Excel script that manipulates data from external sources isn't going to wait around for you to manually fill in a bunch of worksheet tabs."

And there's the problem right there. CSV can't contain tabs, formatting data, formulas etc, etc.

ODF is an open text-based format that any program capable of outputting ascii can create, and which can contain that metadata. You
Reckon you coul write a Perl script to output;

          <formula="oooc:=SUM([.A2:.A4])" office:value-type="float">

Great, you've just added a formula to your spreadsheet before Calc's even seen it. Adding worksheets, formatting and other stuff's just as easy. That's why you don't need scripting in your spreadsheet.

Re:The real solution

[spikedvodka]

but... see http://yro.slashdot.org/article.pl?sid=07/05/22/22 23236 Won't that send all of your browsing habits to McAfee?
(likewise with the new anti-phishing things in FF/IE7)

Re:The real solution

[Anonymous Coward]

Prove it!

Re:The real solution

[Serious Simon]

Not enabling scripting by default is *exactly* what is implemented in OpenOffice.org. The user has to explicitly allow macros to be executed before such a "virus" could do any damage or spread itself. So this "bad bunny" hardly poses any threat.

Re:The real solution

[Pollardito]

i don't know, but once we've gathered together a list i say we make an .untrustworthy TLD and force them all to switch-over to that

Correct time....

[Anonymous Coward]

The correct time was at the beginning of the project, as it always is with security issues.

The backdoor from hell

[packetmon]

So how long should we count down to until someone embeds the backdoor from hell in not only Linux, but Solaris, then the BSD's... As an FYI... I've got a functional backdoor-worm for Free and Open ... Just makes no sense to even post it. Many don't even get what I mean when I state "there is a world of pain coming your way if you do that" ... Mark the calendars, I give it about 9 months before something ala SOBig/Blaster hits the *nix scene...

Re:The backdoor from hell

[truthsearch]

I give it about 9 months before something ala SOBig/Blaster hits the *nix scene...

You just conceived it? Congratulations! Do you have a name picked out?

Re:The backdoor from hell

[Anonymous Coward]

That script needs to be run as root and any OS can be compromised once you're there.

Still, scumware makers are clearly going to target linux, making sure granny and vendors know that you don't have to be root to install a user app would be a definate plus.

Re:The backdoor from hell

[ettlz]

You just conceived it? Congratulations! Do you have a name picked out?

The "backdoor from hell" already has a name: hello.jpg.

Re:The backdoor from hell

[MobyDisk]

How is this related to this discussion? The post links to a shell script that must be run as administrator. Not something that can be embedded into an OpenOffice Javas plug-in running as non-admin.

Re:The backdoor from hell

[Anonymous Coward]

Mark the calendars, I give it about 9 months before something ala SOBig/Blaster hits the *nix scene...

Actually, you're about 19 year too late:
http://en.wikipedia.org/wiki/Morris_worm

Having 15 more years of experience dealing with these kinds of threats would probably explain the the million-times difference in the number of malware items available for Windows versus the sum of number malware items available for all of the different Unixen that have ever been written.

This is one of the reasons why gray-pontytail Unix hackers desparage systems like Windows -- it's a "why, oh why, didn't they learn from our mistakes? If they had just copied us, or at least learned from our mistakes, then people wouldn't keep asking me to fix thoe damn Windows boxes!"

Re:The backdoor from hell

[jimicus]

FWIW, I agree that Unix, like any desktop computer system, is only as secure as the user who's sat in front of it.

IMO, all these people saying "Unix can't suffer from viruses therefore it's secure!" are living in a fools paradise where they don't appear to have realised that the "executable file infector which spreads when the infected file is executed"-type virus is all but dead, and most things described as viruses today would be more accurately described as trojans.

I don't think anything much will change in terms of that perception unless and until there's a major worm attack.

Re:The backdoor from hell

[Anonymous Coward]

Uhm, wtf? This script require to be runned as root. If someone run something as root on your PC, it means your computer is already fucked up. So where is the real exploit?

That is not different from a classical stupid macro virus, with all scripting power gently provided from Microsoft Office. Do you remember? Create a document, insert a nice VB script that send a copy of the document to all your friends with subject: "You really should read it". And you don't even need to be runned as Administrator.

Virus Name

[T-Bone-T]

How does one come up with a name like "SB/Badbunny-A"? Virus names never make sense to me.

Re:Virus Name

[Anonymous Coward]

FTFA

"The worm attempts to download and display an indecent JPEG image of a man wearing a bunny suit performing a sexual act in woodland."

Re:Virus Name

[T-Bone-T]

So you cover Badbunny. What about the rest of the name?

Re:Virus Name

[chill]

SB = StarBasic, because it is written as a StarBasic macro.
-A = First variant. If someone modifies it to do something else, then you'll see -B, -C, etc.

  Charles

Re:Virus Name

[TenBrothers]

So what you're saying is, they just ripped off the naming convention of racehorses.

Re:Virus Name

[chill]

Dunno, I've never paid attention to racehorse names.

Each AV company names things slightly differently, but the general method is:

TYPE/Common-VARIANT

Type can be "W32" or "TROJ" or "VB" or "SB", etc.

Common is a descriptive common name. In this case, the virus places a file called badbunny.js or badbunny.py and downloads a file called badbunny.jpg. Thus "badbunny" was chosen.

Variant is usually alphabetic, starting with A and going into double letters (AA, AB, etc.) if necessary.

How are racehorses named?

Re:Virus Name

[TenBrothers]

Horses are generally named for their parents. Especially if one of them is world-famous. An example would be if you had (to just come up with random names) Seattle Slew and Delta Dawn as the sire and dam, the resulting horse would often be named something like Seattle Sunrise or Gamma Slew or...you get the picture. It's not 100%, especially if the sire and dam aren't particularly famous. But it's typical.

Re:Virus Name

[T-Bone-T]

Thanks, that's exactly the kind of information I was looking for.

Re:Virus Name

[nuzak]

How do they deal with single names like Secretariat or Seabiscuit? Or is this a more recent convention?

Documents shouldn't run code

[Anonymous Coward]

Documents shouldn't run scripts unless explicitly authorized to do so. That goes for word processors, spreadsheets, PDF readers, email clients and web browsers. The problem is that the world is full of dickheads who needlessly distribute documents that require executing script, so users end up clicking yes every time.

Imagine how few viruses and trojans there would be if requiring script was the exception rather than an unfortunate rule.

Oh well, we can all dream.

Re:Documents shouldn't run code

[DragonWriter]

Documents shouldn't run scripts unless explicitly authorized to do so.

Running scripts should not be a binary issue. Scripts should always run, by default, in an appropriate security sandbox, and only get additional privileges through explicit user interaction or through some kind of trust mechanism.

Programs that load scripts from external sources should not be gaping security holes, just because I trust a program doesn't mean that my only choices with a script should be trust it as much as I trust the program running it or not trust it at all.

Re:Documents shouldn't run code

[Anonymous Coward]

The usefulness of a scripts is often directly proportional to the privileges granted. Javascript is hobbled for use in browsers yet it plays a key role in the majority of browser security problems and what do you do when a script manages to break out of it's sandbox? Chroot or BSD jails are one thing but the average user will gladly grant a script extended privileges just to shoot the monkey.

We've heard this argument that sandboxing is the cure to scripting ills for years now, it isn't working. I say it's time to stop behaving like an old woman and tackle the problem directly ;-)

Re:Documents shouldn't run code

[Just Some Guy]

Documents shouldn't run scripts unless explicitly authorized to do so. That goes for word processors, spreadsheets, PDF readers, email clients and web browsers.

....except, of course, that PDFs are Turing-complete scripts that tend to make pretty pictures.

Re:Documents shouldn't run code

[Anonymous Coward]

PDFs are Turing-complete scripts

No, that would be postscript.


Postscript != PDF


Acrobat reader has an embedded javascript interpretor, also used in program installation and updates.

Re:Documents shouldn't run code

[codemachine]

Sounds a lot like Java. Therefore it will never fly.

There will always be a vendor like MS to make everything so much easier for us, without thinking about the consequences. It will happen on Linux too. Some would argue it already is (just compare most Linux distros to OpenBSD for example), just not nearly as bad as on the Windows platform.

Featuritis is an illness that is cross platform I'm afraid. Many small and efficient projects seem to be doomed to become bloatware, once they've become popular.

Re:Documents shouldn't run code

[DragonWriter]

Sounds a lot like Java. Therefore it will never fly.

There will always be a vendor like MS to make everything so much easier for us, without thinking about the consequences. It will happen on Linux too.

Really, in this particular case, its an application issue not an OS issue, and its already happened with regard to plenty of Linux apps that support scripting.

Having a fairly secure OS doesn't you limited good if applications that run with reasonably broad permissions, for good reason, themselves serve as platform for code that doesn't run in an environment with adequate mechanisms for trust and security.

Featuritis is an illness that is cross platform I'm afraid.

Perhaps, but featuritis isn't really the problem. None of the features enabled by scripting are defeated by proper security. Though, of course, its more work to create a proper security framework, and even more work to provide a user-friendly interface for it, and generally that's a low priority. This is not about an excess of features, its about poorly-considered implementation of features.

Re:Documents shouldn't run code

[DragonWriter]

The usefulness of a scripts is often directly proportional to the privileges granted. Javascript is hobbled for use in browsers yet it plays a key role in the majority of browser security problems [mozilla.org] and what do you do when a script manages to break out of it's sandbox? Chroot or BSD jails are one thing but the average user will gladly grant a script extended privileges just to shoot the monkey.

You can't protect against gullible users. Any attempt at security that makes that a goal is just misguided. At the same time, you can guarantee that users that are paying attention aren't taken advantage of. Failing to provide well-designed tools aimed at doing the latter because the former is impossible is foolish.

We've heard this argument that sandboxing is the cure to scripting ills for years now, it isn't working.

Sandboxing is necessary. It may not be sufficient. OTOH, the fact that sandbox implementations have bugs doesn't mean that it can't be done right.

Re:Documents shouldn't run code

[Anonymous Coward]

Perhaps, but featuritis isn't really the problem. None of the features enabled by scripting are defeated by proper security. Though, of course, its more work to create a proper security framework, and even more work to provide a user-friendly interface for it, and generally that's a low priority. This is not about an excess of features, its about poorly-considered implementation of features. True, but in my case, a document editor would really only require some basic layout and font capabilities to be sufficient (really just a rich text editor would do for many people). And I'd be fine if my PDF reader would just display a simple document. Heck, the worst case of bloat ever must be in the web browser, which initially started as a nice way to view markup, and then later images as well. But now, for some reason, we have all of our basic content viewers functioning as programming environments as well.

Sure, these features could be implemented in a secure way. But in a lot of cases, these features aren't used at all by over 90% of the user base. In the case of "Office Suite" bloat, it is often stated that an individual user only touches 10% of the suite's functionality, but each one touches a slightly different set of features. Hence our "standard" file format and the programs themselves become hugely bloated, and often insecure.

For me, when I'd be perfectly fine with text (instead of HTML) email, rich text documents, and content viewers without a full programming language attached, I do think of featuritis as the problem. Especially when the world standardizes on the bloated formats, leaving a user no real choice but to do the same.

Not to say that I want to go back to ancient computing, or that all features are bad. I like that I can search my PDFs, and can see the use for (probably have used) some advanced layout features in my office documents at some point or another. But it'd be really nice if we just let our document viewers, image viewers, music players, etc do their job, instead of providing a programming environment too. Ship software as software, not as an office document. Let our data just be data. It only makes sense from a both design and security standpoint.

Why not use another alternative?

[El Icaro]

I realize this is just my case, but I only need Linux and I use Koffice for my office needs. I lack enough technical knowledge to prove it but it seems faster and lighter than OpenOffice. Are there any other free (either type) office packages on Windows? How about Mac?

Re:Why not use another alternative?

[Anonymous Coward]

I realize this is just my case, but I only need Linux and I use Koffice for my office needs. I lack enough technical knowledge to prove it but it seems faster and lighter than OpenOffice. Are there any other free (either type) office packages on Windows? How about Mac

LaTeX allows me to easily create documents and antiword allows me to read documents created in the obscure Microsoft Word format. It all depends on your needs. These two applications have granted me office functionality at one employer (a Fortune 500 company, no less), but are less than useful to me at my current job. What dictates your office needs? If it is personal efficiency, you have many choices. If it is blind obedience to an arbitrary standard, you're probably stuck with Word.

Also, you're probably right about KOffice. Pretty much anything is better than OO, though MS Word has the distinction of being roughly equivalent in awfulness. OO has done an excellent job in cloning one of the worst ever word processing environments.

The real problem

[Anonymous Coward]

Scripting itself is a virus that spreads through programmers: once a programmer has seen scripting somewhere it doesn't belong, he feels a sudden urge to add scripting to the project he's working on.

Finally feature compatible with Office

[RobertM1968]

:BEGIN HUMOR:
Well, finally OpenOffice has become a viable Office Suite, having finally added the most notable features of Office, namely script exploit capabilities. It's about time... now there is nothing keeping people from switching to OO!!!
:END HUMOR:

So what's this virus going to do again???

[brunes69]

So I open this OO doc in Linux.... is it going to read my address book and email itself to other people? No, OO does not have access to my Thunderbird address book.

Is it going to infect other binaries in my system? No, they're only writeable by root.

Oh wait this is how it works:

"SB/BadBunny-A spreads by dropping malicious script files that affect the behavior of the popular IRC programs mIRC and X-Chat, causing them send SB/BadBunny-A to other users. These malicious script files are named badbunny.py (for XChat) and script.ini (for mIRC, overwriting the existing mIRC file) and are also detected as SB/BadBunny-A."

So.. this "virus" relies on some twisted assumption that I use XChat, to send itself to other people RUNNING XCHAT, NOT OPEN OFFICE?!?

So tell me again how this is a virus? If I email you a shell script named "Click me.sh" than runs "rm -Rf ~/", is that a virus too?

Re:So what's this virus going to do again???

[Macthorpe]

If I email you a shell script named "Click me.sh" than runs "rm -Rf ~/", is that a virus too? If you listened to some of the people here, you would begin to think so.

Re:So what's this virus going to do again???

[mcrbids]

is it going to read my address book and email itself to other people? No, OO does not have access to my Thunderbird address book.

Why not? Ostensibly, OO will run as user YOU, and YOU have access to your Tbird address book, and so would OO. Unless you're running SE Linux like a bat out of hell (most people don't) or have chroot or suid set up. Most *nix users however, don't have this kind of set up.

Re:So what's this virus going to do again???

[140Mandak262Jamuna]

You fail miserably as a budding virus author. Even a script kiddie knows you should sudo before you take malicious action. bah!

Re:So what's this virus going to do again???

[brunes69]

My point is it's Linux, there is no way for the virii writer to deduce what program I am using to manage my addresses. It could be thunderbird, it could be KABC, etc etc. He will either have to write a ton of code to catch all those cases, or not bother. Oh an even if he does OO will not let him execute a program to send mail.

Re:So what's this virus going to do again???

[Macthorpe]

Curses! Foiled AGAIN!

Re:So what's this virus going to do again???

[BosstonesOwn]

whereis insert_mailapp_here?

because we all uninstall everything we don't use right? you fail to see that they can be written to use other apps, this just happens to use mirc or xchat.

never underestimate a determined thief.

Re:So what's this virus going to do again???

[Anonymous Coward]

No, OO does not have access to my Thunderbird address book.

and then

My point is it's Linux, there is no way for the virii writer to deduce what program I am using to manage my addresses

Are you sure you're not just making crap up?

even if he does OO will not let him execute a program to send mail.

The article was weak on details in terms of what's possible, it just explains what it does, not what it could do. But it sounds like it's capable of writing arbitrary files.

Drop nasty.pl in ~, add "perl ~/nasty.pl" in .bashrc. Sure, it's linux, maybe you don't even use bash. Maybe you don't have perl installed or in your path. But I think you're being rather cavalier in assuming linux is automagically going to protect you.

Re:So what's this virus going to do again???

[idontgno]

If your victim is running Debian or one of its children, there are always alternatives.

Re:So what's this virus going to do again???

[Anonymous Coward]

> If I email you a shell script named "Click me.sh" than runs "rm -Rf ~/", is that a virus too?

Actually no. In order to be run on Linux it would need have the execute attribute set, and it won't be. So 'clicking' it, at worst, will display the text or open it in an editor.

Re:So what's this virus going to do again???

[Anonymous Coward]

> So tell me again how this is a virus? If I email you a shell script named "Click me.sh" than runs "rm -Rf ~/", is that a virus too?

No, because it doesn't replicate itself without your assistance. SADBunny is capable of copying itself onto other systems without your knowledge, assuming the right conditions are met. This is what makes it a virus, and not just a simple piece of malware such as what you proposed.

Re:So what's this virus going to do again???

[Anonymous Coward]

"..there is no way for the virii writer to deduce what program I am using to manage my addresses. It could be thunderbird, it could be KABC, etc etc. He will either have to write a ton of code to catch all those cases, or not bother."

You think too small. They only need to catch ONE case (preferably the most popular), and then once exposed to the masses there will be a stastical hit.

Re:So what's this virus going to do again???

[garett_spencley]

If the virus were to target a specific distro, like Ubuntu, then it could make assumptions. It could even check for both Evolution and Thunderbird in the OO user's home DIR and use either or if present.

If the virus creator were especially vigilant then they could test for all sorts of installed applications with existing and exploitable/profitable data under ~/

Re:So what's this virus going to do again???

[joe 155]

"Unless you're running SE Linux like a bat out of hell"

You say it like there is something wrong with running SE Linux or that it will make your experience of Linux worse. I run it and I've only ever had one problem which we managed to diagnose and file a bugzilla report which got it fixed within 4 days... not bad really. I can honestly recommend it for everyone.

I do see the problem though which you mention, namely that you can still do enough damage whilst running as user - especially because it could copy the /home/user/.thunderbird/signons.txt (or whatever its called) and the /home/user/.pidgin/accounts (or whatever...) and send those on, which would certainly cause a problem for most users...

This seems to be an issue which the community could do with dealing with

Re:So what's this virus going to do again???

[Locklin]

It's not hard to write a script that greps all the text files in the user's home directory and parse out all the email addresses. It could then use it's own code to send off those emails, thus, no need to actually use or know about installed email programs.

Re:So what's this virus going to do again???

[mibus]

Does anything stop this from saving a new ~/.bashrc with "rm -rf ~/*" in it?

Re:So what's this virus going to do again???

[Anonymous Coward]

Nope. And more chillingly, nothing stops it from adding this either

alias su "sudo rm -rf /"

yet another bogus Linux 'virus' story ..

[rs232]

This worm or virus depending on who is saying it, requires Perl, XChat and write and executable access to be able to run. None of which applies to any self respecting Linux users computer. Yet another bogus Linux 'virus' article. Must be a slow day for real news.

"They are attacking the vulnerability of people's brains ", Graham Cluley, Sophos

Re:yet another bogus Linux 'virus' story ..

[geekoid]

I don't know of any wide distro that doesn't have Perl or xchat.
Getting write and execute permissions is a concern. Because they wider the Linux audience, the more people will want to double click on an attachment to see the 'dancing ponies' or whatever.

Sad, but true.

Re:yet another bogus Linux 'virus' story ..

[MooseTick]

"any self respecting Linux user"

Have you ever taken a look at who you are talking about?

Re:yet another bogus Linux 'virus' story ..

[MrSenile]

Actually, xchat isn't on my Slackware distribution for what it's worth.

Not that I use ICQ/Other much anyway, as it tends to be a security hole.

And when I do use it, it's chrooted to a protected account anyway.

Feel free to infect my chrooted jail all you want. Really :)

That's the biggest issue that I think a lot of Linux advocates are saying is the big difference between Windows and Linux.

Both don't protect against absolute incompetence, but if you're going to be boned, get boned on Linux. Most people who get boned on Linux won't be boned as root and as such, other than loosing personal information won't have to go through the pain of a completely reformat and reinstallation.

Painful as hell, but not a total loss.

Re:yet another bogus Linux 'virus' story ..

[Anonymous Coward]

Maybe you're too young to remember HappyNewYear, or ILoveYou, or a dozen other highly-publicised attacks that relied on vulnerabilities far less subtle than this.

Nobody tried to argue that they shouldn't be called "viruses". But if Linux is involved, suddenly we get a lot more picky about our language?

Re:yet another bogus Linux 'virus' story ..

[Anonymous Coward]

you don't need to chmod +x, last time i check, you could use a .desktop file (under kde at least) to run a binary on clicking...

Sounds interesting but...

[Anonymous Coward]

Proof of concept nice..

But come on a script? whats it gunna do delete some files? ..

I guess you cant take the silly human factor out of it .. since most great hacks use social engineering skills too. I suppose it is plausible to implement something that uses a local exploit ( perhaps ) to elevate privileges.

Why must Sun

[gillbates]

Copy even Microsoft's mistakes?

I mean, really. We've known about macro viruses for 20 years, and the danger of putting executable code in documents for about the same, and yet, in 2007, an open-source application, backed by a major UNIX vendor is released with this vulnerability?

Apparently many eyes do not make bugs shallow. I guess the community was asleep at the switch. Or maybe, something in the process is broken. Or maybe Sun just doesn't care.

Now, lest you think this a troll, consider: Security and virus immunity have been a big selling point for open source systems. Until now. Sun is a large player in the open source arena, and this makes everyone else - secure or not - look bad. Security was the major selling point for OO, and now that it's questionable, I'm not sure where Sun is going to go with this: they can't compete with Microsoft on features, OO is far from a universal standard (which means you're going to be plagued with interoperability issues), and OO's last major selling point is that it is free as in beer.

Re:Why must Sun

[geekoid]

Did you read what needs to happen to run this virus?

hello?

Re:Why must Sun

[secPM_MS]

Users are impressed by features. Reviewers are impressed by features. The review articles are filled with tables tabulating what product has what feature. So people acquire stuff that has vast numbers of features that they will never use. Features sell. Just look at consumer products.

More features = more attack surface = lower security.

Running downloaded (generally untrusted) code = rich extensibility = bad security. After all, the code writer is doing what they want, not necesarily what you want.

The default document format for Office 12 is docx, which does not support macro functionality. Despite its addiction to rich functionality (remember, customers want it), Microsoft has gotten better over the past few years. If OO / Firefox / ... is going to play the feature addition race with MS, they are going to dive headfirst into the same mud lake Microsoft went into first and we can expect that it will take them some time to figure out how the manage the associated issues.

Re:Why must Sun

[guruevi]

To say it with Gates' words: it's not a vulnerability, it's a feature.

If you RTFA it's not a self-propagating virus that doesn't require interaction or stupidity by the user. But then again, the general populus is stupid and clicks yes for everything.

It's a 'script' that does something bad, not a virus. It's not even close to a macro 'virus'. You could call it a trojan by a far call.

Re:Why must Sun

[bkr1_2k]

Not to be thick, but since when has security been a selling point for OO? I've heard a lot of things about OO over the years, but not once have I heard, or spoken of security as a selling point. Have I (and all my friends) been out of the loop somehow?

Most people don't consider security when they're thinking of writing a document. They think about how they format their documents, how people will read their documents, and how much that will cost them. Other than that, I think most people don't give a damn. Security just isn't a factor for a word processor in most users minds.

Re:Why must Sun

[BosstonesOwn]

It still does something you don't want it to ! What if it ran a simple wget command with uname as input? downloaded a nice little app to your tmp , maybe execute a bug for escalated privaledges and starts chowning your box ?

Your tmp is read and write but not execute right ? Or your home directory ? Plenty of things it could do. hook a script to an alias , so when you type a simple command like ls it starts up a nice spam engine.

Lots of creative uses for the execution of a script.

Lords of grammer please don't smyte me ;)

Re:Why must Sun

[Serious Simon]

...copy Microsoft's mistakes?

Well, they DIDN'T.

The default behaviour of OpenOffice.org with a document containing macros is that the user has to explicitly allow them to run.

Is it AIDS?

[Anonymous Coward]

I mean come on. The worst possible publicity for Open Office would be, "Oh, yeah, I used it once. Then....BAM! AIDS!"

Re:Haha

[Macthorpe]

I think it's satire.

I hope it's satire.

Re:Haha

[cyfer2000]

If "it is TECHNICALLY IMPOSSIBLE for a Mac, or Linux machine to malfunction in any way, from any cause", then what's wrong with your keyboard?

Re:The real solution - Replying to myself

[needacoolnickname]

I should have put a bit more thought into that.

I read this all the time. Don't go to untrustworthy websites.

What should one do? Should they run a whois on every site before going to it? Should they then run a background check on the site owner and the technical contact, if it's not bogus or private? What if it is? Then what does a person do?

People who go to warez sites or any movie/music download site they can find off a search engine deserve what befalls their computer - because one has to take risk for a reward. If they don't want to pay for something that is for sale or go through the effort to find it a wee bit less conspicuously then their computer be damned.

Past those people though, what info would you give grandma about going to a trustworthy web site when what she really wants is some nice wallpaper and screensavers?

The real problem - legacy code.

[Shoeler]

OOo's problem IMHO is that it's an old program suite masquerading as new material. The backwards compatibility, which is necessary to its continued growth, is its albatross.

I am a developer, but the caveot is I don't know jack about the code and its current iteration. I could and may be way off base, but here goes anyway.

The only way you'll ever address it is to start. From scratch. Build the core of the program with security in mind. Converters have to pass through that core security layer. Add-ons need to pass through that layer. Even your own code has to.

Of course the manpower needs of this would be tremendous so it'd never happen.

But Google's doing something similar - they basically seem to have started from scratch and they pass all the apps through their backend, which presumably is superior to most work done on OOo or MS Office.

saving Grandma from Linux ..

[rs232]

How will Grandma do any damage if she don't have root access. Can you point me to a URL or email me a link that runs venomous from a mouse click.

Re:saving Grandma from Linux ..

[Anonymous Coward]

Thank god /usr/bin is read-only! Its sentimental value is irreplaceable. Grandma can, of course, get /home back off the install disks. Hey, wait.

Re:saving Grandma from Linux ..

[Anonymous Coward]

You could never trick granny into running the equivalent of

rm -rf ~/

on Windows. Good thing granny is smart and isn't running with admin privileges too. Oh, wait...

Re:saving Grandma from Linux ..

[Anonymous Coward]

Don't you know that all grandma's have root access?

Re:saving Grandma from Linux ..

[toadlife]

root is not required to turn Linux (or Windows or OSX) into a Spam/DDoS bot, so I think Grandma can do plenty of damage without it.

What's the problem

[Anonymous Coward]

The net community should embrace these viruses which encourage open, peer-to-peer sharing of documents?

Proof of Concept that...

[halfloaded]

OpenOffice really does violate Microsoft patents. /ducks

Most people don't work in financial companies

[Rix]

Those that do can enable scripting. There's no reason to expose the vast majority who will never, ever, use that functionality to the risk. Which is why I said "disable by default" and not "rip it out and burn it".

You are correct that vulnerable functionality should be in a protected wrapper. However, this will simply reduce, not eliminate shenanigans. Clever monkeys will still find a way.

In the darkest nightmares of Linux geeks....

[jd]

....Just when you thought it safe to go back to the wordprocessor....

(Cue screen of XRoach for no obvious reason)

....from the darkest of nightmares comes a haunting tale of OpenOffice viruses.....

(Images from DOOM, for the oblig. explosions and gratuitous violence)

....an innocent who went too far....

(Typing on an XChat console, the first related scene so far but still stupid)

....amongst the ruins of a once-great empire....

(Scene shifts to Sun Microsystems and then to the OpenOffice group - vaguely related, sort of)

....and the darkest passions of a genius....

(Switch to any old virus research lab, nobody can tell them apart)

(Switch to a movie certificate for Open Virus, the Movie, rated C++)

Microsoft says open source violates 235^H6 patents

[Filter]

Oh great, one more MS patent to worry about.

Trust

[Carcass666]

Scripting is a very important part of Office productivity suites. This is not going to change. But what does have to change is the notion of "I'll just toss in a macro with my document/spreadsheet". In reality, macros can get so complex, especially with Microsoft Office's ability to set up references to COM libraries, anything but the simplest macros require careful distribution.

Documents and spreadsheets should not have macros. Ever. The Office vendors need to make it a lot easier to create macro files that are distributed differently than document files. If you have to send along macros to recalc/resort a spreadsheet or something, they should go in a different file. When you open the macro file, the Office app should state which macros that are being activated, and give you the option to use them temporarily or permanently, and by default do not allow them access to the file system unless you specify otherwise, etc. Enabling/disabling macros is not enough, there needs to be levels of trust.

Certificates are good things, especially if you are a company that uses macros a lot internally. But for an individual, getting a code signing certificate by a trusted authority is cost prohibitive and difficult. The Office macro engines simply need to do a better job of limiting the exposure to macro vulnerabilities and make it easier for Joe User to distribute macros in a "responsible" manner.

Re:Trust

[inquisitor]

Some of this is done in MS Office 2007 - new-style Office documents with macros embedded are indicated with a .docm, .xlsm, .pptm type extension (as opposed to .docx, .xlsx, .pptx). What's more, Office refuses to open the document if it's renamed to the non-macro containing extension, giving a "file corrupted" error. Even then, Office is set to refuse to run all macros that aren't "trusted" by default, so it gives an information bar saying that macros are disabled and giving you a chance to enable depending on the document.

Now, if they just stop hiding extensions by default in Windows we're all set, although at least macro-enabled documents have a different file icon (with a red exclamation mark in it).

OO already does that.

[twitter]

Is to stop enabling scripting by default in software that has no real need of scripting. Hasn't even Microsoft learnt this by now?

OO's default is to not run macros. The user get's a warning and has to say "yes" to the thing. This is the best that can be done and still be "compatible" with M$ Office.

A much better solution is to simply use free software, where all of the functionality is provided by best of class applications rather than back of the envelope macro functions. There are programs to do just about everything now.

If you need to make scripts, Gnumeric is a good example. It can use perl scripts but they are not something that goes with the sheet itself. Debian and other distributions provide the best of them for histograms and other analysis. Users can write and distribute more, if they must, but it's not something that is going to spring out of email and eat your system. Neither will the OO scripts, but default.

Re:OO already does that.

[Macthorpe]

OO's default is to not run macros. The user get's a warning and has to say "yes" to the thing. This is the best that can be done and still be "compatible" with M$ Office. Isn't this the exact same 'security feature' that you've been saying is so shit about Vista?

Re:OO already does that.

[Macthorpe]

Are you going to clarify that, because I was under the impression that offering the user a Yes/No choice when asking to run something risky was exactly what UAC is.

Re:OO already does that.

[cottandr]

UAC warns about almost everything.

Tasks that will trigger a UAC prompt, if UAC is enabled, include:[3]. * Changes to files in %SystemRoot% or %ProgramFiles%
* Installing and uninstalling applications
* Installing device drivers
* Installing ActiveX controls
* Installing Windows Updates
* Changing settings for Windows Firewall
* Changing UAC settings
* Configuring Windows Update
* Adding or removing user accounts
* Changing a user's account type
* Configuring Parental Controls
* Running Task Scheduler
* Restoring backed-up system files
* Viewing or changing another user's folders and files

from wikipedia, the free encyclopedia.

Installing applications? I don't need a warning when I'm installing an application. I know that I'm installing an application.

However, I may need a warning that the file that I am opening has a script in in that could be a virus.

Oh, and by the way, have you ever heard of a malicious device driver?

Re:OO already does that.

[Macthorpe]

Isn't that more of an indication that an operating system does far more than a Word clone?

Re:OO already does that.

[dedazo]

Oh, and by the way, have you ever heard of a malicious device driver?

Clearly you've missed the whole point of UAC. It's designed to let you carry out an action that requires administrative rights, while running under a non-admin account. Ever see that KDE or GNOME root prompt when you open an admin tool? Same thing. If you're installing a driver, it's assumed you are already an administrator and generally know what you're doing, so there's no need for a prompt. If you're running in 32-bits, you get a warning about unsigned drivers. If you're in 64-bits you can't even install unsigned drivers at all.

This is no different than any OS. There are situations where it's assumed you have measure of knowledge and responsibility (ie, a fucking clue) about the task at hand. Peppering you with questions would be downright annoying. Alternatively, you can run under an admin account and never see UAC at all. That's your choice.

Re:OO already does that.

[SEMW]

Installing applications? I don't need a warning when I'm installing an application. I know that I'm installing an application.

[...]

Oh, and by the way, have you ever heard of a malicious device driver? How you never heard of a malicious program? Apparently not. Which is strange, because trust me, there are LOTS of them around in the Windows world. Yes, you know when you're installing an application -- that's the whole point! The prompt is asking you "Have you just double clicked on the installer of a program you wish to install, or have I just popped up seemingly for no reason whilst you were browsing dodgy websites?" If the former, then you click 'allow'; if the latter, you click 'cancel' and go to windowsupdate to download the patch for whatever zero-day Internet Explorer exploit your pr0n website was using to try and install stuff on your computer.

Oh, and regarding malicious device drivers -- Creative's sound card drivers spring to mind :-) ... Seriously, they certainly do exist; and if installed some types have free reign to run in kernel mode. I most certainly do want my Operating System to warn me before giving a bunch of code that sort of leeway with my system!

Re:OO already does that.

[hateful monkey]

Then why does it prompt me EVERY time I open my RSS reader? Including needing a password if I am running in a non-admin user? Why does an RSS reader need admin access?

Re:OO already does that.

[Kalriath]

Malicious device driver? Oh yes, two offhand. Starforce, and Sony's rootkit.

That list sounds quite fine, really.

Re:OO already does that.

[dedazo]

Your RSS reader is accessing something it really shouldn't. A lot of software does and will continue to think it has the go of the whole box. Unfortunately that will only change with time.

I can't think of a scenario where an app like an RSS reader would need admin-type access, so if possible I'd suggest you notify the creators and tell them it breaks in Vista.

What reader is this? Personally I use Google Reader so I'm not familiar with the desktop apps.

Re:OO already does that.

[Quantam]

"Installing applications? I don't need a warning when I'm installing an application. I know that I'm installing an application."

Oh wow! A celebrity on Slashdot! Everyone say hello to Dilbert's boss!

"Oh, and by the way, have you ever heard of a malicious device driver?"

They're called rootkits, Jim. Maybe you've heard of them.

Somehow I have a feeling that the joke's gonna be on me: that this guy was just trying to see how dumb people would believe he is, and isn't really that stupid. At least that would preserve my faith in humanity...

Re:OO already does that.

[sid0]

Haven't you learnt already? He's a troll. That's all. Set him as a foe, set foes to -6, and be done with it. It's useless conversing with this guy and his sockpuppet.

Re:OO already does that.

[Anonymous Coward]

crash and burn willy!!

Re:OO already does that.

[hateful monkey]

RSSOwl http://www.rssowl.org/ I agree that whatever it is doing shouldn't be necessary but I just wish I had a choice between answering the prompt EVERY time I open this, and turn off UAC completely. I can't believe that Microsoft didn't read some of the beta reviews that mentioned that the UAC could be much less annoying if it had mechanism for "whitelisting" an app. Maybe they just couldn't think of a secure way to implement it.

Re:OO already does that.

[dedazo]

I believe that the intent is to force the people who create the applications to clean up their act and release software that does not behave that way. If you ask me, they should have done this in the 9x->2K transition and we'd be all the better for it, but backwards compatibility simply didn't allow that.

Seriously, I suggest you drop that app, and send an email to the publisher detailing why you did it. I dropped three or four apps myself when I moved to Vista. Either I can live with the hassle because of the value provided by the application, or I can drop it and go somewhere else. That's the only way software vendors will feel the heat.

Re:OO already does that.

[Macthorpe]

I know that, and you know that. I'm here to make sure everyone else does :)

Ding!

[twitter]

You found 215 of Ballmer's 238 patents. Now, I'm afraid you will be executed by a chair flying squad.

Good thing OO's default behavior is to display a warning that won't run the macro when you push "OK".

Re:Ding!

[RobertM1968]

Oooh... I wonder how that will work on Vista?

Vista: Open Office wants permission to generate a pop-up requesting approval to run a possibly malicious script... Cancel/Allow

...Allow

OO: OO needs permission to run a script... Cancel/Allow

...Allow

Vista: Open Office is trying to run a script... Cancel/Allow

...Allow

Vista: Steve Ballmer is about to throw a chair at you... Allow/Duck & Allow

Re:Haha

[kdemetter]

The sadness of your post is that your attitude will increase the chance for insecurity . it's not secure just because it's linux/mac or whatever . it's secure because of the effort people put in it , because of their awareness to security . The funny thing about security is that a heavy breach in security usually leads to better security , while blindly believing that you are secure leads to some insecurity .

Exactly how is this going to affect OO?

[camsbad]

Despite Sun's OpenOffice.org developer Malte Timmermann's claims to the contrary, this kind of embedded scripting attack represents a real threat to OpenOffice.org users. I don't understand how this could threaten OpenOffice.org, M$ has been allowing this for 20 years and look where they are. Do folks actually think that because some lame virus that depends on at least 2 other programs being installed to work, actually "represents a real threat"??

Nothing here, move along now ...

In Russia ...

[Anonymous Coward]

Pure ASCII text doesn't infect me!!!
It's impossible to infect me!!!

I'm writing and reading ...

ASCII text: YES.
M$ doc: NO, THANKS!.
Sun OO odf: NO, THANKS!.
HTML with/without JavaScript: NO, THANKS!.

OpenOffice team: WHY?? Are you NUTS??

[KWTm]

My previous posts have heaped enough criticism on OOo, so I won't do that here, no matter how good it might feel to vent my frustration.

What I want to do is figure out why OpenOffice is such a steaming pile of crap. Why would someone want such a slow, bloated program? Who decided it would be a good idea to turn on scripting by default? When are they going to make a decent user interface?[1] Well, I think I've figured out a few places where OOo is not like other open source software. Perhaps we could learn some lessons from this.

OSS starts out by "scratching an itch", as the wisdom goes, but OOo did not start that way. It started with StarOffice, proprietary software acquired by Sun and then open sourced. A heartfelt thank you from me to Sun, but unfortunately, open-sourcing the software has not made it better. Instead, I suspect that little pieces here and there have been added to the StarOffice code, until the software became an incongruous quiltwork that did not run smoothly. I mean, Java for some things but not others? No way to insert current date as text? (Have they fixed that in recent versions, by the way?)

Or maybe that wasn't it; instead, perhaps it was the management that dictated the features. "My daughter says MS Word has SuperMacro ScriptEnhance-o-rama," said the manager, "and I told her, OpenOffice will have it, too!"

Or maybe it was (heaven forbid) an actual developer who decided that changing the font on the main text would not change the font within a table?

I mean, it's hard to imagine that they did any sort of usability testing at all. What it does feel like is that they were trying to keep up with Microsoft Office while forgetting about the spirit of OSS.

Can someone offer insight into what happened? Because I wouldn't want that to happen to any other OSS project. (Firefox, are you listening?) Ironically, although I fear that Firefox may be starting to suffer the same feature creep as OOo, I think the best thing for OOo to do now is to take a page from the history of Mozilla: scrap the code. Mozilla did it, and it took over a year, but when they finished, it was a masterpiece that everyone could be proud of.

So, start over. Stay focused. Otherwise, people will migrate over to AbiWord. You know what, better yet, maybe OOo can send some of their developers over to the AbiWord team, and maybe KWord, too.

Aaargh, the amount of wasted talent that goes into OOo.

-----
End notes: s/OpenOffice[^.]/OpenOffice.org/g --you know what I meant.

[1] "Decent user interface": they can start by not having multiple menu options share the same "underlined letter" shortcut.

Re:OpenOffice team: WHY?? Are you NUTS??

[Haeleth]

So, start over. Stay focused. Otherwise, people will migrate over to AbiWord.

Yeah, I heard the AbiWord spreadsheet is particularly good.

Re:OpenOffice team: WHY?? Are you NUTS??

[KWTm]

Yeah, I heard the AbiWord spreadsheet is particularly good.

Yes, I think so too. (Well, Gnumeric isn't officially part of Abiword, but you know what I mean --the default spreadsheet application on the Ubuntu GNOME desktop.) I use it despite having a KDE desktop.

O RLY

[dedazo]

The user get's a warning and has to say "yes" to the thing

And this is different from "M$" Office in what way?

MOD PARENT UP

[Anonymous Coward]

Not enough people seem to know the actual definition of a computer virus. The ONLY requirement for a program to be considered a virus is that it's self-replicating. It does NOT have to be malicious.

Why per-file scripting?

[IkeTo]

I still don't quite understand why the hell somebody would like to use scripts in their office documents, especially if they are so capable. Documents are things people send and read without even thinking about, with no expectation that there can be any harm. Why program must be attached to those, rather than some extensions that is independent of the document, which people can only install when they can be expected to know the possible harm?

You CAN NOT have a "leaky" sandbox.

[argent]

The kind of "leaky sandbox" that we're seeing here was virtually unknown in the '80s and '90s. If a macro language had any kind of ability to work outside the codument layout itself, it was either restricted to applications where it was a moot point (if the preprocessor for your compiler could run scripts... so what, the code in between the preprocessor directives could do anything) or it was a mistake and the abaility was removed when it was discovered (as in the case of ghostscript).

In 1997 Microsoft introduced Active Desktp, which included a deliberately "leaky" sandbox... controls and scripts that were on pages considered "trusted" could get anything up to full local-user access. In addition, Microsoft responded to Word macro viruses NOT by restricting the scripting language in Word (as expected) but by putting in checks to disable the ability to even examine macros if a document seemed suspicious. And they still haven't learned their lesson.

What's worse, this practise is spreading. While nobody has extended this model nearly as far as Microsoft, Firefox XPI installation involves having a web page request installation of unrestricted macros, and Apple lets you run software installers automatically if the user has left "Open safe files after downloading" enabled.

This kind of thing HAS to stop.

If you design an "inherently safe" scripting language, on ethat does not provide any hooks from *within* the documentto even requests the ability to modify mor ethan the document itself, then any security holes are bugs and can be patched without inconveniencing users. More powerful tools should always be run or installed from outside the document, explicitly under user control, and preferably from a version of the application that doesn't include a mechanism to access remote documents and is not ever invoked from a browser or mail program... or any other application intended to work with untrusted documents.

This design, which used to be taken for granted (the idea of an email worm that could even potentially be run by just viewing an email message used to be a *joke*... everyone *knew* that nobody would be stupid enough to make the Good Times virus real) is not "clumsy" or "inconvenient". It's more convenient than the environment we're in now where applications are perpetually bringing up "Hey! I'm about to do someting stupid! You wanna let me?" dialogs that people reflexively swear at as they approve the stupid action.

We need to turn this around, folks. Bring back the sandbox, don't even include the commands to write files in the sandboxed versions of the macro interpreter, and stop turning the Internet into some kind of bad science fiction movie where the earthlings infect the alien computer from a Powerbook.

Re:You CAN NOT have a "leaky" sandbox.

[3choTh1s]

If you design an "inherently safe" scripting language, on ethat does not provide any hooks from *within* the documentto even requests the ability to modify mor ethan the document itself, then any security holes are bugs and can be patched without inconveniencing users. More powerful tools should always be run or installed from outside the document, explicitly under user control, and preferably from a version of the application that doesn't include a mechanism to access remote documents and is not ever invoked from a browser or mail program... or any other application intended to work with untrusted documents.

"Inherently safe" scripting is the problem though. Scripting is only useful because it allows you to automate things that you do repetitively. Lets see some of the things you might do repetitively... You might need to open a lot of Word documents one after another. But that means you have to open files on the filesystem. You might have the script add stuff to these files and save it. But then you'd need to be able to save files to the filesystem. And then what if you want to use data from a file that isn't a Word document. Well then you'd need to be able to open a read/write any file regardless if it's a Word document or not. And finally what if after processing these documents you want to start an external program that does some other function with the files. Well then... you'd need to execute programs.

Again scripting is only useful if you are allowed to automate processing of many files, not just the one you are working on. Speak what you want about VBA, but it's a decent automation platform, security issues set aside. We're talking about an office here, take a look at the common applications that an office would use. Word processor, email program, spreadsheets, internet browser. And you want to make your work as easy as possible. Any automation platform needs to be able to integrate the things you use and be able to do with it what any regular person can do. Unfortunately it does mean that we have to deal with security issues, but that's the cost of being more efficient with our time.

Re:You CAN NOT have a "leaky" sandbox.

[argent]

"Inherently safe" scripting is the problem though.

It's not really a problem. We know how to design inherently safe languages. We also know how to design interfaces by which users can running scripts in unsafe languages without allowing untrusted objects to run these scripts.

Scripting is only useful because it allows you to automate things that you do repetitively.

That's a little simplified, but basically true, and also irrelevant. First, a lot of repetitive tasks are things like filling out standard forms and reports, creating standard letterheads and layouts, and other tools that don't modify state outside the document. Second, when you're doing more complex things repetitively, you're generally doing them *to* documents... having the scripts embedded in one of the documents is hardly an ideal user interface.

You might need to open a lot of Word documents one after another. [...]

You don't provide that mechanism in the scripting language that can be embedded INSIDE a word document, you provide it in the scripting language that the user explicitly runs from OUTSIDE the document in an installed component (plugin, application, etcetera) that the embedded language can't access.

There's no reason why these can't both be based on the same language. You design the language to have a basic set of control flow operations, and a mechanism for the *application* to expose additional capabilities to the script by importing objects and libraries... the base language doesn't include any of these things.

Then the embedded version gets loaded with objects that expose the document itself, but no more. The external version gets the whole world pulled in.

To distribute objects to to user you can go three or four ways. First, you can embed those object *in* documents in some packaged format... without providing any mechanism to automatically install the package: the user needs to explicitly select the object and request it be installed as a plugin. Second, you can provide extensions by an an out of band publishing mechanism: for example you can distribute them on a local file share, or on an internal web site. Thirdly, you can use the same mechanism you use to push out patches, hotfixes, and upgrades within the site.

virusscanner bloat

[pe1chl]

was emailed directly to Sophos from the virus developers ... who dutyfully included it in their signature database, so it will be looked for in millions of computers even though it is not in the wild.

meanwhile, our computers get slower and slower. virusscanners eat up lots of resources and become ever slower. I recently noticed clamav takes 13 seconds to scan an infected .scr file of 16kb before deciding that it is safe (because it not yet had the signature).

wouldn't it be time that antivirus companies slim down the signature lists a bit. of course it is cute to boast a "number of signatures" above 100.000, but who is really getting benefit from the scanning of all those hypothetical viruses?

Not just finance companies - even departments

[jimicus]

In any company, there's a whole bunch of departments other than IT.

Those departments don't always fancy calling the IT department when they have an IT requirement - particularly if it doesn't seem that complicated. There is always someone in the department who knows their way around Excel (and possibly Access) better than any of their colleagues. So they cobble something together in some 'orrible mess of VB macros linking who knows what files, referential integrity or scalable design be damned.

Were you to audit any sizeable business for spreadsheets made somehow interactive with scripts and badly designed databases thrown together in Access, I guarantee you'd be amazed and disturbed in equal measure. And you really don't want to start trying to figure out which ones have somehow become critical to the business.

This has been going on for years. Try taking that functionality away today, you might as well suggest replacing their computers with slide rules.

Re:Not just finance companies - even departments

[Anonymous Coward]

"This has been going on for years. Try taking that functionality away today, you might as well suggest replacing their computers with slide rules."

Yep. I work at a small engineering company that does stress analysis and structural design for one of the two big aircraft companies. We've automated the hell out of Excel and even Word to allow us to do a shitload more work than you could otherwise do. Reliability and robustness don't really matter because it's still very eyes and hands on. The actual analysis isn't done in Excel, but our data storage, massaging, presentation and the running of the Mathcad worksheets is all helped out by Excel scripted with VBA.
Basically the scripting allows us to spend more time being engineers and less time doing stupid repetitive and error prone crap.

Who?

[Anonymous Coward]

Those absolute useless MS losers. Only a currupt cabal of selfish satanic world destroying puppy eaters would do something like this.

This is another example of how lazy, unprofessional and systemically screwed up they are.

When are people going to stop buying their crap? This would NEVER happen in an open source environment.

What a bunch of know nothings...huh?? Oh, OPEN office...um, nevermind.

Umm, don't lose your sense of proportion..

[cheros]

(1) it's a first in the entire product lifetime. Not bad going, consider it a sign that it's becoming mainstream that someone has bothered at all, and it's lab only. How many IN THE WILD infections have we had for Word and Excel so far?

(2) unlike MS Office, the macro data is clearly documented in the file format (and it's a separate section file in the OO ZIP archive) and you could thus choose to zap that part from a file or, less brutal, that you stand at least a chance of examining what is in it before passing it on to the desktop. Most importantly, you can do such examination without using OO at all. Hell, you could even be perverse and write an examiner in VB :-).

(3) OO isn't just competing on price. There are features in OO that have made me a fan quite a while back. Its word prediction, for instance, is a major efficiency improver if you have to often write documents with complicated or complex names or long terminology. The ability to push out PDF forms from a text document is excellent. The fact that it only has ONE macro language instead of one for each component (VBA for Word VBA for Excel). The fact that presentations export to Flash. The ability to still read Word documents that Word itself crashes on because it FUBARed on formatting (quite a common problem). Etc etc etc. You've not used it long enough IMHO, I'm personally actually getting to a point where Word just doesn't cut it for me anymore. It may look fancy, but it doesn't do the work as well.

(4) worthy of a separate point: an absolute USP IMHO is that OO's interface has not significantly changed over the years. It has always intrigued me that nobody spotted the apparent incongruity between the prevalent feeling that switching to a Linux desktop is too much relearning, yet throwing operators in the deep with a new OS UI AS WELL AS a new Office UI is somehow acceptable. Just imagine how much time could have been saved already if they'd been on OO and were thus not subject to relearning practically everything. That, and the lack for license management is something that impacts TCO downwards..

Mod parent up (nt)

[Anonymous Coward]

nothing to see here, move along.

Really

[twitter]

And this is different from "M$" Office in what way?

The M$ default is to run it, and the user is root, and M$ Office costs about $400, and I can go on with this if you like.

Re:Really

[dedazo]

The M$ default is to run it

No, the 'default' is to ask you what you want to do.

and the user is root

If you are running under an admin account, it's by choice. Office (and Windows) works perfectly well under non-admin accounts.

costs about $400

This is relevant because...?

I can go on with this if you like.

Sure. If you're going to admit you're wrong then by all means. If you're going to keep doing the "well M$ is teh worse" logic, then no.

Why don't you just admit you're wrong? Is that so painful?

Re:Really

[Anonymous Coward]

God, how can anyone be so fucking stupid

Seagulls

[Anonymous Coward]

Have you ever heard that joke about the seagull consultant? You're like that. When in doubt, shit over everything and make lots of noise. The "M$" thing helps as well.

Re:Haha

[The Master Control P]

It's not that... PEBKAC.

Well, they wanted Word functionality

[bl8n8r]

I guess you got it.

Is that in octadecimal?

[SEMW]

Microsoft says open source violates 235^H6 patents "235^H6 patents"? Assuming that's in octadecimal, I make that approximately equal to... [does some quick back-of-the-envelope calculations]... 1.979*10^22830 patents.

Damn, that's a lot of patents.

Re:Haha

[Anonymous Coward]

The sadness of your post is that you didn't catch the OP's "hilarious" "parody" of a linux user.

Signed scripts?

[xtracto]

using restricted-mode execution by default and access by signed digital certificates.

Yeah, similarly on how signed extensions would make firefox safer??

I have yet to se 1 (ONE) signed firefox extension...

Distributed Trusted Repository

[Doc Ruby]

The way to be safe(r) from scripts is to require OO.o to check the signature of any script against the sigs of all scripts in a distributed repository. All the scripts' sources are open. People can test them out, and report them to the repo's (distributed) security team. If OO.o doesn't find the sig of a script in the repo, OO.o can submit the script to the repo and warn the user their script is untested before executing it.

This kind of architecture is one way that Debian (and derivatives) is protected by APT from security holes. In fact, Debian would be even better if every install (eg. upgrading "make install") ran this process, including generating a sig for an unknown package, then sending it to the repo(s).

This (auto)registration and testing system leverages the inherent advantage of OSS. Automating the efficiency of the global community using it makes Linux the easiest and safest OS. That's how you conquer the world without getting hurt.

Official word from ML

[Anonymous Coward]

(from [ooo-announce] )
Subject: [ooo-announce] Press reports regarding "SB/BadBunny-A" virus

There has been press comment recently about the "SB/BadBunny-A" virus
affecting OpenOffice.org reported by an anti-virus company.[1]

Industry best practice would have been for the anti-virus company to
report the virus to the OpenOffice.org security team before making this
information public. Unfortunately this did not happen in this case.
OpenOffice.org will issue a detailed analysis once a copy of the virus has
been received. However, due to the volume of interest in the media, the
Community would like to issue the following comments, based on the
information available.

Macros are a useful part of any office suite, allowing users to automate
repetitive tasks. These tasks include potentially destructive actions such
as modifying and deleting files, which is why macros are of interest to
virus writers.

It is possible in any capable macro language, including those in
OpenOffice.org, to write simple 'virus-like' programs. Currently,
OpenOffice.org follows industry best practice to mitigate the risk. If the
software detects macros in a document being opened, by default it displays
a warning and will only run the macro if the user specifically agrees. In
any macro-capable tool, it is essential to verify the origin and
authenticity of the document before executing macros. To this end,
OpenOffice.org has also included advanced digital signature capabilities.

The OpenOffice.org engineers take the security of the software very
seriously, and will react promptly to any new issues. To do this, they
require access to the source code for the alleged virus. From information
currently available, it is unlikely that this new virus contains any novel
features which would require a software patch. Technically, it is not even
a virus, as it is not "self-replicating" - with OpenOffice.org's default
settings, it cannot spread without user intervention.

However, the OpenOffice.org community repeats the consistent message from
security experts that users should never accept files from unknown
sources. For any security issue, please visit OpenOffice.org's Security
Team page [2] and send a note to (mail removed by poster).

[1] http://www.sophos.com/security/analyses/sbbadbunny a.html
[2] http://www.openoffice.org/security/