Word Vulnerability Compromised US State Dept.

hf256 writes "Apparently hackers using an undisclosed (at the time) vulnerability compromised the State Departments network using a Word document sent as an email attachment. Investigators found multiple instances of infection, informed Microsoft, then had to sever internet connectivity to avoid leaking too much data!"

Great news for open formats

Well this should push everything towards open document formats a bit more, so it might just be a good thing...

Re:Great news for open formats

It would be so easy to just install StarOffice on each computer (keep Word), and ask the more technical departments to start using it, if only to save docs in Word format at first. I did this with the last company I worked at, nobody ever even complained. The cost was very minimal, and it actually saved a lot of money and time when an excel file corrupted itself. MS could not open it, but SO opened then re-saved it in MS format, then it worked fine.

Re:Great news for open formats

I heard the install was faster/easier, and it was. You're right about the support - never tried it, but I did want to contribute to the open source concept, and $ rules the world. I knew those above me wouldn't notice an extra $20 on each pc, but they were scared of 'non-professional software', so to be able to tell them there was support was a necessary safeguard.

Oh, btw, they were using that excel sheet to keep track of a fleet of buses (this co was archaic in their IT dept when I got there). A radio dispatcher was frantically telling the bus drivers there was a computer problem and to 'hold tight' for 15 minutes till I got there, then 5-10 more minutes to figure out MS file recovery wouldnt cut it, and 5 to install SO from network and fix the prob. The only serious occasion that pitted MS vs SO and the results were stark. So no Im not on Sun's payroll, but the story ought to be a commercial, and I walked out like a hero so I'm happy to tell it.

Re:Great news for open formats

Instead of waiting for the 1.5 - 2 hours for Microsoft Office to install I just downloaded star office and installed (took all of 10 minutes).

You know, you can't really count the amount of time it takes to download Microsoft Office via BitTorrent from a pirate site as part of the install time. Office 2003 took me about 15 minutes to install. Quit making shit up.

Re:Great news for open formats

Does that include the time for downloading updates, rebooting, and praying towards Redmond?

Tom

Re:

I think one problem is that we are making document formats that are far more than just what they are ostensibly used for. Word processing documents are generally meant to hold blocks of text, some pictures and charts, and some internal pointers. Does a w

Re:

But if Open Document Text does almost everything .doc files do, how can we be sure it doesn't have similar back doors?

Re:Great news for open formats

Use the SOURCE, Luke.

With open software, you can look at the source code and see exactly what it does and test it for all the vulnerabilities you want and get them removed, by yourself if you find yourself so talented. Only the monkeys in Redmond know what is really going on in Windows, and anyone using their products is dependent upon MS and MS only for a solution. That may come in days, weeks, but most likely months after a vulnerability is found. Meanwhile, someone ends up releasing details of the vulnerability, then codes up a nasty bug to take adavantage. The fact that MS software is so full of holes and has no real peer-review process among the general population of all possible coders interested in fixing bugs is its weakness in comparison.

Re:Great news for open formats

> With open software, you can look at the source code and see exactly what it does

I though even the OS community had realised by now how ridiculous this argument is. World economy would in effect come to a halt if every company and public office started to scan source codes for potential vulnerabilities. This is hardly a selling argument and being a wise-ass about it has never helped the OS movement.

Having a goal of zero vulnerabilities is such complex software as an office suite is strikes as feasible only to an ideologist nerd. In practise there will always be vulnerabilities as long as human beings will be responsible for the design and programming. And having gazillions of eyes searching through the source code presumably on the company dollar is not effective way to remove those faults.

Re:Great news for open formats

Parent is making a valid point, and is not a troll, whoever modded them that way. The 'more eyes' argument doesn't really work for me either. I use open source software all the time, and I rarely have a look at the source code, and even less frequently take the trouble to understand even a small part of it.

What does work for me with open source is that the nature of open, distributed development tends to promote code modularity, which helps keep those defect counts down. And the fact that code is publicly available exerts an influence on developers to publish code they aren't be ashamed of (unlike what happens in proprietary software development with tight deadlines set by the sales team making unrealistic promises to clients - I have been there).

However, there is a real distinction between defect-free software (probably does not exist) and software that intentionally includes back-doors. With open-source, you can have more confidence that there is no back door, spy-ware, or anything else that shouldn't be part of the application. But it certainly doesn't mean the software will be defect free.

Re:

a) Everyone CAN look at it [the source] (so no backdoors will be implemented)

a) is correct, conclusion is not (see Ken Thompson's attack against a compiler)

Actually, I would say a)'s conclusion was correct (and yes I'm familiar with the attack you ment

Re:

Yeah, because those open document formats are 100% safe from coding bugs in the applications that parse them.

And unquestionably OpenOffice is immune to parsing [secunia.com] errors [secunia.com].

Hmmm...hackers

It seems those hackers missed the Philippines and accidentally hit the state department instead

Quick

Quick everyone, the bandwagon is getting ready to leave. Jump on.

Re:Quick

What magical office software do you use that is apparently 100% bug free?

Re:Quick

What magical office software do you use that is apparently 100% bug free?

Emacs

*ducks and runs*

Re:

Does that include a decent text editor yet?

Re:

But does it run Linux?

Re:

Tsk, tsk, Linux users these days...
I type OpenOffice.org Writer XML in VI... In the format's ZIP-compressed form!

Scary

The fact that a simple Word document can cause such a big problem is really sad. How can you tell a few thousand of people not to open word document attachment? I mean, where I work, users receive tons of documents (pdf, office, autocad) files by email from vendors and such, I guess the only defense is good email filtering but still a 0-day attack would make that useless.

Re:Scary

The fact that a simple Word document can cause such a big problem is really sad. How can you tell a few thousand of people not to open word document attachment?

Of course this is a popular article because it's more evidence of how Microsoft's 'professional' products are so amateurish, but you're right, you can't tell thousands of people not to open an attachment.

The root of the problem doesn't lie in Word documents, or Word for Windows. The problem lies in Windows, period. The operating system is practically incapable of separating important and sensitive data from junk-mail and untrusted documents from the outside. In such a place as the State Department, it's scandalous.

Whilst hypothetically, Linux is also vulnerable (eg: through some flaw in Open Office), a properly configured system could protect itself without needing to rely on the end user to manually screen every bit of junk they come across. Sure there would potentially have been some corruption of data, maybe some low level leakage, but really, this all points to a hopelessly overcomplicated and poorly designed OS. Naughty Bill!

Re:

It's interesting to note that the compromises on our machines don't occur on our terminal servers or the critical PC's, they only occur on the one's that "absolutely must have" administrative access on their local machine.

A properly configured windows sys

Re:Scary

If our helpdesk can't solve the issue within 15 minutes the PC is re-imaged no questions asked no data saved.

Christ on a stick! That's a bloody good reason to hide EVERY problem from the IT Nazis.

Does anyone ever get any work done?

Re:Scary

Actually its a very effective method for both the IT team and the people who desperately need the administrative access. IT aren't required to understand every little john doe program that these people can want to install so they don't have to support them (this is very clearly communicated to these users).

It also means that we have a relativly standardised form across the board despite having PC's everywhere and very quickly weed out the users who think they're smart but aren't really.

An example of a good operator: there's a bloke over in administration who I would swear used to work in IT. He's got Open Office installed when everyone else uses Microsoft Office, he uses firefox, thunderbird and trillian for his messenger. About 500 theme packs and a few other bits of software. According to our helpdesk logging system he has only ever called once, and this was when he patched himself for the new daylight savings time last year. Everyone else had the problem as well.

Also, so that those who aren't aware know, you don't have to be a local administrator to install a network printer. Anyone hooking a printer directly to a PC in a corporate environment is either a director or an IT who has lots to learn.

Re:Scary

Actually its a very effective method for both the IT team and the people who desperately need the administrative access. IT aren't required to understand every little john doe program that these people can want to install so they don't have to support them (this is very clearly communicated to these users).

[..]

An example of a good operator: there's a bloke over in administration who I would swear used to work in IT. He's got Open Office installed when everyone else uses Microsoft Office, he uses firefox, thunderbird and trillian for his messenger. About 500 theme packs and a few other bits of software. According to our helpdesk logging system he has only ever called once, and this was when he patched himself for the new daylight savings time last year. Everyone else had the problem as well.

I'd say that's a pretty stupid way to 'administer' your workstations... Why can these people even install all this shit themselves? How can some bloke in administration 'patch his machine' himself? And how does making them not call support because they know they won't fix your problem help with the maintenance of your network. The only thing I can see something like that heading to is an IT support department that only answers the utterly stupid requests and hardware failures. Employees just don't bother to call them because they don't want there machine re-imaged, so they just start fooling around themselves, or ask some guy like the 'bloke from administration' to 'fix' their system. Eventually that can only and in a maintenance and security nightmare.

Re:

Data: Storing the data on a samba share, and mapped network drives. To the GP, I would suggest that you haven't had a large corporation to support. We support a nation wide network (ok, so it's australia, we're still a nation!) with only 13 support staff i

Re:

Christ on a stick! That's a bloody good reason to hide EVERY problem from the IT Nazis.

Does anyone ever get any work done?

Depending on your environment, that can actually be the quickest, easiest way to solve a problem.

The GP didn't explain his environment

Re:

actually you can. you just have to be hard core like the military. I work for a military contractor (a university research lab) we received an email telling us to not use word documents what so ever for a certain period of time. and if we didnt comply we l

Re:

The dream of every sysadmin, to have that kind of power... Open a word file and you'll be fired. *sigh*

Re:Scary

Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

Furthermore, buffer overflows could exist in just about any program. There could be one in emacs right now, triggered by reading a file into the buffer. Then it would be "scary.. The fact that a simple text file can cause such a big problem is really sad."

Unfortunately, they didn't disclose the nature of the vulnerability. "hidden software commands" in the mass media could be anything from shellcode to an executable embedded in the document, to a macro. Since Microsoft patched it, it was probably either something that autoran or an overflow.

Re:Scary

Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

Furthermore, buffer overflows could exist in just about any program. There could be one in emacs right now, triggered by reading a file into the buffer. Then it would be "scary.. The fact that a simple text file can cause such a big problem is really sad."

Nice attempt to evade the issue by raking up redundant matters. The crux of the problem here is that MS Word needs or provides Internet access for some of it's functions. Even if it had any buffer overflows, the problem would not be exploitable from remote systems.

The fact that Word is designed to occasionally talk over the internet coupled with it's hooks into the OS via things like VBA etc. is the problem. In fact, the main problem here is not Word or Office, it is the Windows architecture that is vulnerable.

Re:Scary

The crux of the problem here is that MS Word needs or provides Internet access for some of it's functions. Even if it had any buffer overflows, the problem would not be exploitable from remote systems.

Although Word does probably provide Internet access to its macros and other nasties, this was not a necessary condition for this to work. Even if MS Word didn't have any code within to connect to the internet, any supposed exploit would have been able to supply its own. And from the looks of it, this is what happen here. Apparently, this was some kind of call-back program that would somehow tunnel out through the firewall, connect to the hacker's control console and accept instructions from there.

Such a thing is rather complex, and probably not pre-existing within word. It was brought in by the trojan itself.

Re:

Excuse me... how would such a call-back program be initiated,

"Shell code". Typically, a buffer overflow causes some user data (contained in Word document) to overwrite the stack, including the return address. The function in Word where this happened would thus not "return" to its intended spot (the caller), but rat

Re:Scary

Why would you ever open anything not from a source you know if you where in the State Department? ...
FTA (which isn't entirely clear.
The mysterious State Department e-mail appeared to be legitimate and included a Microsoft Word document with material from a congressional speech related to Asian diplomacy, Reid said. By opening the document, the employee activated hidden software commands establishing what Reid described as back door communications with the hackers.
It's not clear but I wouldn't be so quick to say the employee was stupid for opening an email with out knowing the source. If it appeared legit and it was just a plain word doc with not VB scripts then it's not all his/her fault.

And why are you taking aim at governments in particular, any government corporation or single home user could have been fooled by this.

(Insert Troll Here)

Queue the legion of Microsoft apologists, saying things like:
a) It's only because MS Office has the largest market share, this could of happened to any office suite!
b) It's not a big deal, obviously the state department's IT department is incompetent.
c) Damn Hackers, always trying to ruin a good thing!
d) Macs run on Intel processors now, so they're vulnerable too!
e) This is probably because the NSA sponsors SELinux.
f) In Soviet Russia, MS Office hacks YOU!

Did I miss any?

Re:(Insert Troll Here)

g) Cue the Grammar Nazi that points out the difference between "cue" and "queue" :)

Re:

You joke, but I'd point out that a government department (particularly in a large, powerful country like the US) will always be a very attractive target - particularly for blackhats who know what they're doing rather than script kiddies.

Yet the same govern

It proves a set of closed vs open source arguments

1) the attack, once found, would have a bevy of coders working on it (we hope, of course)

2) the testing and regression doesn't have the dependency matrix that Word does, and it's likely that if there was a link, it could be both understood and remedied quickly thru an open code supply chain

3) multiple hackers (oops, I mean coders) would likely offer variances of a patch, of which perhaps several would/could be part of the subsequent 'patched' tree

4) eight weeks is a travesty, and that the State Department of the United States of America didn't have an IDF that could detect the abberant traffic is just plain malfeasant. Heads should roll.

Only fooling themselves

At first, the hackers did not immediately appear to try stealing any U.S. government data. Authorities quietly monitored the hackers' activity, then tripwires severed Internet connections

If you find evidence of a break-in, its possible the attackers are also connecting in a way you haven't yet detected. Hope they know what they're doing. Given their reputation, I doubt [slashdot.org] it [slashdot.org].

The airlock is closing...

"...then had to sever internet connectivity to avoid leaking too much data!"

"Cap'n, we're having a wee bit 'o trouble in IT - we're leaking data down here like no one's bloody business - we may have to sever communications!"

"Scottie - is it really that bad...? Isn't there some alternative that will buy us more time??!! I need more time, dammit man!"

"Cap'n, I'm only a Star Fleet Engineer, not the Queen's magician..."

"Well, Engineer...see if you can pull a rabbit out of your ass and buy me five more minutes before you cut us off. That's all we need to make the jump, and after that you can cut your nuts off for all I care!"

"Aye, Cap'n...do me best - one shit-stained rabbit, com'n up - IT out!"

Opendoc

Well its a good thing the government standardizes on opendoc and does not cater to special interests like Microsofts lobbiests when making requirements for secure workstations.

Microsoft is Like Internet of Old

I had an interesting discussion the other day with some colleagues and we came to a consensus that many Microsoft products were and still are, or at least inherit, a design philosophy similar to that of the Internet when it was first created. The Internet was built on a basis of implied trust and as we have seen in present times, particularly with e-mail and the SMTP protocol, this model of design is a poor foundation. To counter these issues we need to design more and cleverer countermeasures in an escalating war with miscreants; a parallel we also see in Microsoft products with never ending cycle of Anti-Virus and Anti-Spyware updates and patches required to deal with both programming flaws are poor design choices that assumed trust (recall the ILOVEYOU debacle). The real kicker is that you could argue that many of the problems we now face on the Internet are largely due to poor design in Microsoft software which as I noted parallels an original design methodology of the Internet. We've had several articles earlier in the week pushing a view that the Internet needed to be re-architected due to its flawed security design (although I think it's more about commerce and control but I won't go there for now) - is it not also time to re-architect Microsoft and their approach to developing products? Would we even have these problems if not for Microsoft? My two cents.

Must suck to be Lenovo...

...knowing that your products were banned from the State Department for some theoretical and highly unlikely exploit, while Microsoft Word continues to be used there despite a documented (no pun intended) security breach attributed to it.

open formats alone won't save you

It is easy to condemn Microsoft for the vulnerabilities in Office, but the root issue here is the rich functionality in modern office suites. Office came to dominate the market by its rich functionality, tight integration, and ease of use. The addition of sophisticated scripting functionality allowed organizations or integrators to add yet more value. It also created a fertile environment for malicious attackers. As long as the Windows operating system was easily broken, nobody bothered much with attacking the application stack. As Microsoft has raised the bar in the attack resistance of the operating system, attacks have moved up the stack. I was not at MS at the time, but I do not believe that security has at the top of the stack for Office 11 and earlier. I do know that substantial hardening was performed on Office 12, which I believe is now marketed as Office 2007. From my point of view, Office 12 should be viewed as a very important security update to Office 11. I know, they changed the UI. I wish they had left a "classic" option. They didn't. But Office 12 is far less vulnerable than Office 11.

In their determination to sucessfully match Office's rich features, Open Office has acquired similar vulnerabilities. One evaluation I saw some time ago concluded that Open Office was likely to be more vulnerable than Office.

If you want to be secure, run software that does what you need, and NO MORE! Rich functionality and extensibility are the attack points. Not many people want to restrict themelves to txt files or filtered html, let alone edit any longer with editors such as vi or microemacs. Due to their extensibility, pdf and postscript are suspect in the eyes of the truly paranoid, let alone the complex modern formats.

Well in my office

Most people who are not familiar with IT in the US Government have NO IDEA how dependent even the military is on MS products. Think MS based virii, worms and exploits aren't on classified networks? Networks that don't even share a common hardware link to the internet...

Scanning at the mail server.

A sane email policy blocks executable files and archives containing executables, but allowing dot docs in is probably unavoidable.

I wonder then, if it might be possible to scan a Word document for stuff that's not needed. Treat all dot docs that have VB in them as executables and block them out. You might go so far as to attempt intelligent analysis of the document to make sure it consists only of code that would reasonably be generated by a human being. Perform sanity checks on certain variables and so on.

hacker != criminal

-1 for subby for using the word "hacker" to describe the criminal(s) responsible. You'd think the /. crowd would know better.

Tom

Re:Microsoft Logic

It doesn't necessarily mean that there are more security holes. Remember the Win2K patch that killed Compaq desktops with a particular network card?

Re:OS and Apps must be seperate!

That's where "sane" operating systems differ. User space and the OS are heavily separated, in fact, user space for each user is separated from other users, and almost all services run as a unique user. This intentional separation provides very robust security, and is absolutely necessary to creating a secure system. I cannot blame anyone but MS for this... and not the MS Word or Office team. If the OS were properly designed so that user space applications were properly separated, issues such as this would not exist.

this has nothing to do with separation of the user space- the app is run as a unique user, and the information stolen is that available to that user. there is no suggestion that privilege escalation occured in this attack.

How the **** is this insightfull?

Wheres the -1, Misinformed?

That's where "sane" operating systems differ. User space and the OS are heavily separated, in fact, user space for each user is separated from other users, and almost all services run as a unique user. This intentional separation provides very robust security, and is absolutely necessary to creating a secure system.

Are you implying that is not the case with windows??? A quick look in task manager shows some system processes running as your user account, some as "LOCAL SERVICE", some as "NETWORK SERVICE", (both restricted accounts) and some as "SYSTEM" (=root). And a quick look at top on my linux box sure doesn't show "almost all" services running as unique users.

And sure, its up to the administrator to configure it so the user account is not an administrator, but I've never seen a government system where a domain user account has local admin rights.

In the specific case of this vulnerability, the word document was able to run arbitrary executable code as the current user. This presumably allowed access to network shares, and then sending the data back out (via HTTP most likely). That sort of thing would be possible with any operating system.

The only area you are correct in is that on linux the flaw could be patched quicker... But in a large organization, it likely could still be preferable to block the exploit with IDS/firewall rules than by rolling out a client patch...