Slashdot Mirror
Black Hat Talk Demonstrates New Document Exploits
darthcamaro writes "Remember the days of the viruses embedded in email attachments? They're coming back, according to a pair of researcher talking at Black Hat this week: '"If you have installed all Microsoft Office patches and there are no 0 day vulnerabilities, will it be safe to open a Word or Excel document?" TT asked the audience. "The answer is no."'"
Anybody worth their salt knows that any attachment can be dangerous. You can hide all sorts of things in them. Especially for files that allow arbitrary things to be embedded in them, like Word documents.
Of course it's not safe to open the document. It could be a "Starbuck should be a dude" rant.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Now that is the definition of a self-defeating post.
I'm not connected to the internet. Workaround that!
If you did, then others can.
The reason why the answer is no is because of hybrid document attack techniques. TT explained that in the hybrid document exploit a Flash file is embedded in Excel or Word document.
Ok Microsoft... why the hell are you allowing Flash inside Word and Excel documents in the first place?!?
NSFW image! Mod down!
Your argument restricting executable code covers a variety of technologies from OLE to html email. The same reason these technologies suck is also why they are so popular. On one hand you can embed stuff and do more! On the other hand they can embed stuff and do more.
A lot of the time that executable code is to do shinystuff, like embed fancy animated charts in documents. One of the worst cases of all is in Windows Media, which will happily run scripts (Exploitable scripts) in media files without prompting or informing the user - and will do this based on magic bytes to identify filetype rather than extension. This lead to the proliferation of fake-mp3 malware on p2p networks. The purpose of the scripts is to allow for updating of the DRM technology and to allow for unauthorised media files to automatically direct the player to a website to purchase a licence.
Yes... THAT YOU KNOW ABOUT - of course, if you know about them, they're not zero-day vulnerabilities.
What a load of crap. YES there are, probably, vulnerabilities that you don't know about (I.E. zero-day vulnerabilities). NO you can't EVER say "there are no 0 day vulnerabilities", because if there are, you won't know about them until you find them! Who the fuck wrote that, anyway? A 0-day vulnerability is a vulnerability that you DON'T KNOW EXISTS.
Anyone who THINKS that there are no zero-day vulnerabilities is, statistically speaking, WRONG. There are. And therefore, yes:
If you have installed all Microsoft Office patches ... will it be safe to open a Word or Excel document? ... The answer is no.
Because a Word or Excel document could always exploit a vulnerability that you DON'T KNOW ABOUT.
That's sort of the whole fucking point, right?
I've seen a lot of fake media files require you to purchase a licence you get a "this requires a licence, do you want to retreive it" type yes/no dialogue and only take you to a website on a yes click.
I'm calling BS on your claim it does anything more than this. If MP3s were exploitable outside of encouraging you to visit a questionable site, you'd see a whole lot more malware infected MP3s sent as email attatchments. It's not unthinkable this could be exploited but I doubt it's any easier exploting that than just generally finding a vulnerability in a common codec. Especially with DEP and ASR.
There line between code and data is rather fuzzy. In the end, both are big lumps of bytes that will be processed by some software, which will then cause your computer to take certain actions. The problem is that the software processing the bytes will often happily allow things to happen that would generally be considered undesirable (e.g. sending spam).
In my view, the problem of malware is so persistent, because the vast majority of software vendors have an insecure by default approach. Software is developed in unsafe languages (allowing exploits like buffer overruns), runs on operating systems that will happily run any code they are told to run, and we are trying to secure this mess by patching the holes after they are found.
If we wrote software in languages that were memory-safe, this would prevent attacks such as embedding executable code in data files, and getting it to run through buffer overruns. If we used whitelists for software that is allowed to run (I imagine this like the repositories in Debian/Ubuntu/..., where you can choose your own trusted providers), this would stop untrusted code from running.
This would bring us closer to secure by default, where you would have to do extra work to make your system insecure, instead of having to constantly fight an uphill battle to keep up some semblance of security.
Please correct me if I got my facts wrong.