Feeds

MS anti-Trojan shield fails to protect older Offices

MOICE and sleazy

5 things you didn’t know about cloud backup

Microsoft's attempts to protect against the growing range of attacks targeting unpatched flaws in its Office application suite are only likely to be partially effective, according to security experts.

The tool, Microsoft Office Isolated Conversion Environment (MOICE), is designed to protect against malformed Office 2003 documents that attempt to exploit 0-day vulnerabilities. The technology works by converting Office 2003 binary format files to Open XML format using Microsoft Office 2007 system converters. Microsoft claims three possible failsafe outcomes: successful conversion, failure to covert, or the converter (though not the underlying OS) crashes.

Clearswift ThreatLab manager Pete Simpson said the technology is to screen out malware from legacy Office document formats, a problem that arises in the first place from "lax sanity checking of field bounds and pointers" that leads to buffer overflow flaws and the like.

"These vulnerabilities are abound in pre-2007 Office documents and have been exploited by attackers to force buffer overflows leading to execution of the attached Trojan code, when an unsuspecting user simply opens a malformed Office email attachment. Furthermore automated 'fuzzing' tools are capable of generating numerous document malformations that will cause Office applications to crash," he said.

Simpson said that MOICE is all very well - as far as it goes - but it only helps users of Office 2003 or higher to enjoy the sort of improved protection offered by the different file formats that come with Office 2007. Office XP, or lower, users aren't protected.

Hackers are increasingly attempting to smuggle maliciously constructed Office files that attempt to exploit unpatched vulnerabilities past corporate defences. Although 0-day Office Trojans have been observed since late 2004, they increased by a factor of ten through 2006, according to ClearSwift.

The assaults often take the form of targeted attacks - featuring plausible message hooks and spoofed headers - designed to trick workers in sensitive sectors such as government into opening infected files.

"The attackers - organised crime or hostile intelligence services - are scoping targets for theft of specific valuable information. The problem is certainly not going to vanish any time soon. Neither will Microsoft's response - MOICE - solve the problem until all Office users upgrade to 2003 or higher," Simpson added. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.