Feeds

Word 97 feature spawns no-brainer pilfering exploit

Document Collaboration Spyware

  • alert
  • submit to reddit

The next step in data security

Microsoft is investigating a security vulnerability with Word 97 which allows attackers to filch documents from victim's PCs using a craft social engineering attack.

If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. The files will be silently wrapped into the returned file using the INCLUDETEXT field, one of the numerous hidden fields embedded in Word documents.

An attacker would need to know the location of the file he wants to nick (hardly the greatest problem) but apart from that there's little to protect users from this attack. No viruses, no macros - just a Word document ready to place your most sensitive data in the INCLUDETEXT field, possibly using a white font or some such to conceal the pilfered text.

This is not a flaw, it's a feature - which can't be disabled by users. True, you can manually check the fields, but will the average user do that do that?

What should happen is that user confirmation (via a dialog box) for all includes should be mandated, and until Microsoft comes up with a fix along these lines then paranoia has to be the order of the day.

Information about the cracker-friendly feature was first published by Alex Gantman on BugTraq on August 26. He describes the attack as one involving Document Collaboration Spyware, which sounds about right to us.

Woody Leonhard, editor of Woody's Office Watch, brought the issue to wider attention in his email newsletter, and carried out tests which showed the problem may also affect Word 2000 and 2002.

This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security. ®

Security for virtualized datacentres

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
Profitless Twitter: We're looking to raise $1.5... yes, billion
We'll spend the dosh on transactions, biz stuff 'n' sh*t
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.