Feeds

Word 97 feature spawns no-brainer pilfering exploit

Document Collaboration Spyware

  • alert
  • submit to reddit

Boost IT visibility and business value

Microsoft is investigating a security vulnerability with Word 97 which allows attackers to filch documents from victim's PCs using a craft social engineering attack.

If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. The files will be silently wrapped into the returned file using the INCLUDETEXT field, one of the numerous hidden fields embedded in Word documents.

An attacker would need to know the location of the file he wants to nick (hardly the greatest problem) but apart from that there's little to protect users from this attack. No viruses, no macros - just a Word document ready to place your most sensitive data in the INCLUDETEXT field, possibly using a white font or some such to conceal the pilfered text.

This is not a flaw, it's a feature - which can't be disabled by users. True, you can manually check the fields, but will the average user do that do that?

What should happen is that user confirmation (via a dialog box) for all includes should be mandated, and until Microsoft comes up with a fix along these lines then paranoia has to be the order of the day.

Information about the cracker-friendly feature was first published by Alex Gantman on BugTraq on August 26. He describes the attack as one involving Document Collaboration Spyware, which sounds about right to us.

Woody Leonhard, editor of Woody's Office Watch, brought the issue to wider attention in his email newsletter, and carried out tests which showed the problem may also affect Word 2000 and 2002.

This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security. ®

Application security programs and practises

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
Chrome browser has been DRAINING PC batteries for YEARS
Google is only now fixing ancient, energy-sapping bug
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.