Feeds

Word 97 feature spawns no-brainer pilfering exploit

Document Collaboration Spyware

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Microsoft is investigating a security vulnerability with Word 97 which allows attackers to filch documents from victim's PCs using a craft social engineering attack.

If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. The files will be silently wrapped into the returned file using the INCLUDETEXT field, one of the numerous hidden fields embedded in Word documents.

An attacker would need to know the location of the file he wants to nick (hardly the greatest problem) but apart from that there's little to protect users from this attack. No viruses, no macros - just a Word document ready to place your most sensitive data in the INCLUDETEXT field, possibly using a white font or some such to conceal the pilfered text.

This is not a flaw, it's a feature - which can't be disabled by users. True, you can manually check the fields, but will the average user do that do that?

What should happen is that user confirmation (via a dialog box) for all includes should be mandated, and until Microsoft comes up with a fix along these lines then paranoia has to be the order of the day.

Information about the cracker-friendly feature was first published by Alex Gantman on BugTraq on August 26. He describes the attack as one involving Document Collaboration Spyware, which sounds about right to us.

Woody Leonhard, editor of Woody's Office Watch, brought the issue to wider attention in his email newsletter, and carried out tests which showed the problem may also affect Word 2000 and 2002.

This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security. ®

Reducing security risks from open source software

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.