Slashdot Log In
First OpenOffice Virus, Not In the Wild
Posted by
kdawson
on Tue May 22, 2007 12:45 PM
from the raucous-laughter-in-Redmond dept.
from the raucous-laughter-in-Redmond dept.
NZheretic writes "According to APCmag, the first cross-platform OpenOffice.org virus — 'SB/Badbunny-A' — was emailed directly to Sophos from the virus developers. The proof-of-concept virus affects Windows, Mac OS X, and Linux systems and uses different methods on each. It has not yet been seen in the wild. Despite Sun's OpenOffice.org developer Malte Timmermann's claims to the contrary, this kind of embedded scripting attack represents a real threat to OpenOffice.org users. Back in June 2000 when Sun first announced the open sourcing of OpenOffice.org, the twelfth email to the open discussion list put forward a two-part solution for providing OpenOffice users with Safe(r) Scripting using restricted-mode execution by default and access by signed digital certificates. In October 2000 the issue of treating security as an 'add-on' feature rather than as a 'system property' was again raised. Is it time to now introduce such measures to the OpenOffice.org Core to greatly reduce any future risk from scripted infections?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The real solution (Score:5, Insightful)
Re:The real solution (Score:4, Informative)
Parent
Re:The real solution (Score:4, Insightful)
Parent
Re:The real solution (Score:5, Funny)
Parent
Re: (Score:2, Funny)
- has content linked in (THAT would open a whole can of trust-this-trust-that now would it!)
- has bugs in web, app or db server.
- accepts malicious content including links to content
- you don't know if you can trust everyone with or who could get admin access to that server.
More or less. But it cant be that hard now can it, because I've heard of people making these decisions in realtime, while they surf.
Re:The real solution (Score:5, Funny)
Hmmm...this sounds familiar.
I think you just described Slashdot.
-- a really old
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Correction -- low 5-digits.
No not the account, I mean you
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Many people get viruses (appearing to come) from well known trusted sources, so this advice is wrong.
The correct thing to say is:
Don't open unsolicited attachments or files, ever .
If in doubt, speak to the sender and confirm its validity.
The real problem (Score:5, Funny)
Parent
Re: (Score:2, Interesting)
I have seen this happen with web pages and FireFox. People complain that FireFox does not work with several web pages, when in reality, those web pages (which are tailored for IE) do not work with FireFox.
etc.
Re:The real solution (Score:5, Insightful)
Parent
Most people don't work in financial companies (Score:3, Insightful)
You are correct that vulnerable functionality should be in a protected wrapper. However, this will simply reduce, not eliminate shenanigans. Clever monkeys will still find a way.
Not just finance companies - even departments (Score:4, Insightful)
Those departments don't always fancy calling the IT department when they have an IT requirement - particularly if it doesn't seem that complicated. There is always someone in the department who knows their way around Excel (and possibly Access) better than any of their colleagues. So they cobble something together in some 'orrible mess of VB macros linking who knows what files, referential integrity or scalable design be damned.
Were you to audit any sizeable business for spreadsheets made somehow interactive with scripts and badly designed databases thrown together in Access, I guarantee you'd be amazed and disturbed in equal measure. And you really don't want to start trying to figure out which ones have somehow become critical to the business.
This has been going on for years. Try taking that functionality away today, you might as well suggest replacing their computers with slide rules.
Parent
Re: (Score:3, Insightful)
And that, of course, is almost directly related to the fact that the MS file formats are closed. With an open format like ODF, scripts for importing data aren't critical, since it's quite easy instead for a program to export it in the proper format, or to write an external script or program to transform data into ODF format. After all, it's XML.
Unfortunately MS has trained industry to rely on scripting to
Re: (Score:2)
The real problem - legacy code. (Score:2)
I am a developer, but the caveot is I don't know jack about the code and its current iteration. I could and may be way off base, but here goes anyway.
The only way you'll ever address it is to start. From scratch. Build the core of the program with security in mind. Converters have to pass through that core security layer. Add-ons n
Re: (Score:2)
Re:OO already does that. (Score:5, Insightful)
Parent
The backdoor from hell (Score:5, Interesting)
Re:The backdoor from hell (Score:5, Funny)
You just conceived it? Congratulations! Do you have a name picked out?
Parent
Re:The backdoor from hell (Score:5, Funny)
The "backdoor from hell" already has a name: hello.jpg.
Parent
saving Grandma from Linux .. (Score:2)
Virus Name (Score:3, Funny)
Re: (Score:2, Informative)
"The worm attempts to download and display an indecent JPEG image of a man wearing a bunny suit performing a sexual act in woodland."
Re: (Score:3, Informative)
-A = First variant. If someone modifies it to do something else, then you'll see -B, -C, etc.
Charles
Documents shouldn't run code (Score:4, Insightful)
Imagine how few viruses and trojans there would be if requiring script was the exception rather than an unfortunate rule.
Oh well, we can all dream.
Finally feature compatible with Office (Score:5, Funny)
:BEGIN HUMOR:
Well, finally OpenOffice has become a viable Office Suite, having finally added the most notable features of Office, namely script exploit capabilities. It's about time... now there is nothing keeping people from switching to OO!!!
:END HUMOR:
Re: (Score:3, Funny)
Oooh... I wonder how that will work on Vista?
Vista: Open Office wants permission to generate a pop-up requesting approval to run a possibly malicious script... Cancel/Allow
...Allow
OO: OO needs permission to run a script... Cancel/Allow
...Allow
Vista: Open Office is trying to run a script... Cancel/Allow
...Allow
Vista: Steve Ballmer is about to throw a chair at you... Allow/Duck & Allow
So what's this virus going to do again??? (Score:4, Informative)
Is it going to infect other binaries in my system? No, they're only writeable by root.
Oh wait this is how it works:
"SB/BadBunny-A spreads by dropping malicious script files that affect the behavior of the popular IRC programs mIRC and X-Chat, causing them send SB/BadBunny-A to other users. These malicious script files are named badbunny.py (for XChat) and script.ini (for mIRC, overwriting the existing mIRC file) and are also detected as SB/BadBunny-A."
So.. this "virus" relies on some twisted assumption that I use XChat, to send itself to other people RUNNING XCHAT, NOT OPEN OFFICE?!?
So tell me again how this is a virus? If I email you a shell script named "Click me.sh" than runs "rm -Rf ~/", is that a virus too?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Why not? Ostensibly, OO will run as user YOU, and YOU have access to your Tbird address book, and so would OO. Unless you're running SE Linux like a bat out of hell (most people don't) or have chroot or suid set up. Most *nix users however, don't have this kind of set up.
Re: (Score:2)
Re: (Score:2)
yet another bogus Linux 'virus' story .. (Score:4, Informative)
"They are attacking the vulnerability of people's brains [guardian.co.uk] ", Graham Cluley, Sophos
Re: (Score:3, Insightful)
Getting write and execute permissions is a concern. Because they wider the Linux audience, the more people will want to double click on an attachment to see the 'dancing ponies' or whatever.
Sad, but true.
Why must Sun (Score:4, Insightful)
Copy even Microsoft's mistakes?
I mean, really. We've known about macro viruses for 20 years, and the danger of putting executable code in documents for about the same, and yet, in 2007, an open-source application, backed by a major UNIX vendor is released with this vulnerability?
Apparently many eyes do not make bugs shallow. I guess the community was asleep at the switch. Or maybe, something in the process is broken. Or maybe Sun just doesn't care.
Now, lest you think this a troll, consider: Security and virus immunity have been a big selling point for open source systems. Until now. Sun is a large player in the open source arena, and this makes everyone else - secure or not - look bad. Security was the major selling point for OO, and now that it's questionable, I'm not sure where Sun is going to go with this: they can't compete with Microsoft on features, OO is far from a universal standard (which means you're going to be plagued with interoperability issues), and OO's last major selling point is that it is free as in beer.
Re: (Score:2)
hello?
Re: (Score:2)
More features = more attack surface = lower security.
Running downloaded (generally untrusted) code = rich extensibility = bad security. After all, the code writer is doing what they want, not necesarily what you want.
T
Re: (Score:2)
If you RTFA it's not a self-propagating virus that doesn't require interaction or stupidity by the user. But then again, the general populus is stupid and clicks yes for everything.
It's a 'script' that does something bad, not a virus. It's not even close to a macro 'virus'. You could call it a trojan by a far call.
Re: (Score:2)
Most people don't consider security when they're thinking of writing a document. They think about how they format their documents, how people will read their documents, and how much that will cost them. Other than that, I think most people don't give a dam
Proof of Concept that... (Score:2, Funny)
In the darkest nightmares of Linux geeks.... (Score:4, Funny)
(Cue screen of XRoach for no obvious reason)
(Images from DOOM, for the oblig. explosions and gratuitous violence)
(Typing on an XChat console, the first related scene so far but still stupid)
(Scene shifts to Sun Microsystems and then to the OpenOffice group - vaguely related, sort of)
(Switch to any old virus research lab, nobody can tell them apart)
(Switch to a movie certificate for Open Virus, the Movie, rated C++)
Trust (Score:4, Interesting)
Scripting is a very important part of Office productivity suites. This is not going to change. But what does have to change is the notion of "I'll just toss in a macro with my document/spreadsheet". In reality, macros can get so complex, especially with Microsoft Office's ability to set up references to COM libraries, anything but the simplest macros require careful distribution.
Documents and spreadsheets should not have macros. Ever. The Office vendors need to make it a lot easier to create macro files that are distributed differently than document files. If you have to send along macros to recalc/resort a spreadsheet or something, they should go in a different file. When you open the macro file, the Office app should state which macros that are being activated, and give you the option to use them temporarily or permanently, and by default do not allow them access to the file system unless you specify otherwise, etc. Enabling/disabling macros is not enough, there needs to be levels of trust.
Certificates are good things, especially if you are a company that uses macros a lot internally. But for an individual, getting a code signing certificate by a trusted authority is cost prohibitive and difficult. The Office macro engines simply need to do a better job of limiting the exposure to macro vulnerabilities and make it easier for Joe User to distribute macros in a "responsible" manner.
You CAN NOT have a "leaky" sandbox. (Score:3, Interesting)
In 1997 Microsoft introduced Active Desktp, which included a deliberately "leaky" sandbox... controls and scripts that were on pages considered "trusted" could get anything up to full local-user access. In addition, Microsoft responded to Word macro viruses NOT by restricting the scripting language in Word (as expected) but by putting in checks to disable the ability to even examine macros if a document seemed suspicious. And they still haven't learned their lesson.
What's worse, this practise is spreading. While nobody has extended this model nearly as far as Microsoft, Firefox XPI installation involves having a web page request installation of unrestricted macros, and Apple lets you run software installers automatically if the user has left "Open safe files after downloading" enabled.
This kind of thing HAS to stop.
If you design an "inherently safe" scripting language, on ethat does not provide any hooks from *within* the documentto even requests the ability to modify mor ethan the document itself, then any security holes are bugs and can be patched without inconveniencing users. More powerful tools should always be run or installed from outside the document, explicitly under user control, and preferably from a version of the application that doesn't include a mechanism to access remote documents and is not ever invoked from a browser or mail program... or any other application intended to work with untrusted documents.
This design, which used to be taken for granted (the idea of an email worm that could even potentially be run by just viewing an email message used to be a *joke*... everyone *knew* that nobody would be stupid enough to make the Good Times virus real) is not "clumsy" or "inconvenient". It's more convenient than the environment we're in now where applications are perpetually bringing up "Hey! I'm about to do someting stupid! You wanna let me?" dialogs that people reflexively swear at as they approve the stupid action.
We need to turn this around, folks. Bring back the sandbox, don't even include the commands to write files in the sandboxed versions of the macro interpreter, and stop turning the Internet into some kind of bad science fiction movie where the earthlings infect the alien computer from a Powerbook.
virusscanner bloat (Score:3, Insightful)
meanwhile, our computers get slower and slower. virusscanners eat up lots of resources and become ever slower. I recently noticed clamav takes 13 seconds to scan an infected
wouldn't it be time that antivirus companies slim down the signature lists a bit. of course it is cute to boast a "number of signatures" above 100.000, but who is really getting benefit from the scanning of all those hypothetical viruses?
Re: (Score:2)
I hope it's satire.