Microsoft is investigating a security vulnerability with Word 97 which allows attackers to filch documents from victim's PCs using a craft social engineering attack.

If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. The files will be silently wrapped into the returned file using the INCLUDETEXT field, one of the numerous hidden fields embedded in Word documents.

An attacker would need to know the location of the file he wants to nick (hardly the greatest problem) but apart from that there's little to protect users from this attack. No viruses, no macros - just a Word document ready to place your most sensitive data in the INCLUDETEXT field, possibly using a white font or some such to conceal the pilfered text.

This is not a flaw, it's a feature - which can't be disabled by users. True, you can manually check the fields, but will the average user do that do that?

What should happen is that user confirmation (via a dialog box) for all includes should be mandated, and until Microsoft comes up with a fix along these lines then paranoia has to be the order of the day.

Information about the cracker-friendly feature was first published by Alex Gantman on BugTraq on August 26. He describes the attack as one involving Document Collaboration Spyware, which sounds about right to us.

Woody Leonhard, editor of Woody's Office Watch, brought the issue to wider attention in his email newsletter, and carried out tests which showed the problem may also affect Word 2000 and 2002.

This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security. ®