Feeds

Word 97 feature spawns no-brainer pilfering exploit

Document Collaboration Spyware

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Microsoft is investigating a security vulnerability with Word 97 which allows attackers to filch documents from victim's PCs using a craft social engineering attack.

If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. The files will be silently wrapped into the returned file using the INCLUDETEXT field, one of the numerous hidden fields embedded in Word documents.

An attacker would need to know the location of the file he wants to nick (hardly the greatest problem) but apart from that there's little to protect users from this attack. No viruses, no macros - just a Word document ready to place your most sensitive data in the INCLUDETEXT field, possibly using a white font or some such to conceal the pilfered text.

This is not a flaw, it's a feature - which can't be disabled by users. True, you can manually check the fields, but will the average user do that do that?

What should happen is that user confirmation (via a dialog box) for all includes should be mandated, and until Microsoft comes up with a fix along these lines then paranoia has to be the order of the day.

Information about the cracker-friendly feature was first published by Alex Gantman on BugTraq on August 26. He describes the attack as one involving Document Collaboration Spyware, which sounds about right to us.

Woody Leonhard, editor of Woody's Office Watch, brought the issue to wider attention in his email newsletter, and carried out tests which showed the problem may also affect Word 2000 and 2002.

This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Microsoft WINDOWS 10: Seven ATE Nine. Or Eight did really
Windows NEIN skipped, tech preview due out on Wednesday
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.