Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Security Microsoft United States

Word Vulnerability Compromised US State Dept. 207

Posted by samzenpus
from the you've-got-a-virus dept.
hf256 writes "Apparently hackers using an undisclosed (at the time) vulnerability compromised the State Departments network using a Word document sent as an email attachment. Investigators found multiple instances of infection, informed Microsoft, then had to sever internet connectivity to avoid leaking too much data!"
This discussion has been archived. No new comments can be posted.

Word Vulnerability Compromised US State Dept.

Comments Filter:
  • by Beuno (740018) <(argentina) (at) (gmail.com)> on Wednesday April 18, 2007 @10:56PM (#18793187) Homepage
    Well this should push everything towards open document formats a bit more, so it might just be a good thing...
    • Re: (Score:2, Funny)

      by aputerguy (692233)
      Friends don't let Friends use Micro$oft...
    • by drago177 (150148) on Wednesday April 18, 2007 @11:26PM (#18793411)
      It would be so easy to just install StarOffice on each computer (keep Word), and ask the more technical departments to start using it, if only to save docs in Word format at first. I did this with the last company I worked at, nobody ever even complained. The cost was very minimal, and it actually saved a lot of money and time when an excel file corrupted itself. MS could not open it, but SO opened then re-saved it in MS format, then it worked fine.
    • Re: (Score:3, Insightful)

      by Gerzel (240421) *
      I think one problem is that we are making document formats that are far more than just what they are ostensibly used for. Word processing documents are generally meant to hold blocks of text, some pictures and charts, and some internal pointers. Does a word processing format really need java script, and support for every feature under the sun?

      However a new format for every feature doesn't work too well either. Perhaps an extendable document format that plainly details what features are used in the docum
    • Re: (Score:3, Interesting)

      But if Open Document Text does almost everything .doc files do, how can we be sure it doesn't have similar back doors?
      • by Eggplant62 (120514) on Thursday April 19, 2007 @01:32AM (#18794299)
        Use the SOURCE, Luke.

        With open software, you can look at the source code and see exactly what it does and test it for all the vulnerabilities you want and get them removed, by yourself if you find yourself so talented. Only the monkeys in Redmond know what is really going on in Windows, and anyone using their products is dependent upon MS and MS only for a solution. That may come in days, weeks, but most likely months after a vulnerability is found. Meanwhile, someone ends up releasing details of the vulnerability, then codes up a nasty bug to take adavantage. The fact that MS software is so full of holes and has no real peer-review process among the general population of all possible coders interested in fixing bugs is its weakness in comparison.
        • by boer (653809) on Thursday April 19, 2007 @03:03AM (#18794803)
          > With open software, you can look at the source code and see exactly what it does

          I though even the OS community had realised by now how ridiculous this argument is. World economy would in effect come to a halt if every company and public office started to scan source codes for potential vulnerabilities. This is hardly a selling argument and being a wise-ass about it has never helped the OS movement.

          Having a goal of zero vulnerabilities is such complex software as an office suite is strikes as feasible only to an ideologist nerd. In practise there will always be vulnerabilities as long as human beings will be responsible for the design and programming. And having gazillions of eyes searching through the source code presumably on the company dollar is not effective way to remove those faults.
          • by mattpalmer1086 (707360) on Thursday April 19, 2007 @04:46AM (#18795287)
            Parent is making a valid point, and is not a troll, whoever modded them that way. The 'more eyes' argument doesn't really work for me either. I use open source software all the time, and I rarely have a look at the source code, and even less frequently take the trouble to understand even a small part of it.

            What does work for me with open source is that the nature of open, distributed development tends to promote code modularity, which helps keep those defect counts down. And the fact that code is publicly available exerts an influence on developers to publish code they aren't be ashamed of (unlike what happens in proprietary software development with tight deadlines set by the sales team making unrealistic promises to clients - I have been there).

            However, there is a real distinction between defect-free software (probably does not exist) and software that intentionally includes back-doors. With open-source, you can have more confidence that there is no back door, spy-ware, or anything else that shouldn't be part of the application. But it certainly doesn't mean the software will be defect free.
            • by peragrin (659227)
              I agree completely.
              Open Source Software isn't defect free.
              Open Source Isn't bug free.

              Not having to rely on a single point of failure --- priceless.

              That point of failure can be hardware, software, or corporate--either yours or theirs. I wouldn't trust all Apple software, an all IBM software, or an all Sun software either, So why would anyone trust an All Microsoft Software? open Source doesn't come from one source. Best of all you have the tools and pieces needed so you can hire a company to patch it fo
          • by mwillems (266506)
            Hang on a sec. The fact that source is open does NOT mean that "everyone" has to look at it. The point is that:

            a) Everyone CAN look at it (s o no backdoors will be implemented)

            b) Some people actually DO look at it (so more bugs tend to be found by a wider audience, more quickly).

            c) Many WOULD look at it if they needed to (a really urgent issue can be solved locally if need be).

            So yes, of course Open Source is good if you want safer software.

            Michael
            • by sqlrob (173498)
              a) is correct, conclusion is not (see Ken Thompson's attack against a compiler)

              b) is also an incorrect conclusion. See the year and a half before finding the hard coded password in Interbase, and the exploitable double free that was in zlib for several years
              • Re: (Score:3, Insightful)

                by zacronos (937891)

                a) Everyone CAN look at it [the source] (so no backdoors will be implemented)

                a) is correct, conclusion is not (see Ken Thompson's attack against a compiler)

                Actually, I would say a)'s conclusion was correct (and yes I'm familiar with the attack you mentioned). The poster did not say "no backdoors can exist in the software", but "no backdoors will be implemented". Assuming the poster meant "no backdoors will be implemented in the software being examined", I would say it is a correct statement -- there i

          • by mattr (78516)
            I get where you're coming from but the reality is probably more interesting. Of course businesses in general won't be looking at source code, but they will have MD5 (or better)hashes. Imagine this instead: finding vulnerabilities in code for popular apps will become bragging rights for budding engineers and a revolution is started when in addition to the ODF being used as a standard document format, major institutions also buy into a standard amount of horsepower and a standard feature set, that is for exam
        • I would not call them monkeys. But your point is well taken, no body in Redmond knows ALL the obscure hack some programmer did to meet shipping deadline way back in 1993, who has since cashed out his options and is swilling tequila in Aruba. Open Source too could have this problem of people working on a project and then going away. But I believe there is greater continuity of coders in the Open Source arena. Mainly because, I think, not many of them have become millionairs swilling tequila in Aruba.
    • Windows has been THE single largest security risk and yet ppl keep using it. MS now has monster lobbyists who simply pay politicians to look the other way. So why would this change things? I can see it happening in only 1 of several ways:
      1. More commercial apps get ported to Linux.
      2. A Windows compromise leads to impeachment of the entire white house such that this is played in the papers OVER AND OVER. For those of you old enough to remember watergate or iran hostage situation, it will make sense.
      3. MS suddenly
    • Re: (Score:3, Insightful)

      by LO0G (606364)
      Yeah, because those open document formats are 100% safe from coding bugs in the applications that parse them.

      And unquestionably OpenOffice is immune to parsing [secunia.com] errors [secunia.com].
  • by Spookticus (985296) on Wednesday April 18, 2007 @10:57PM (#18793197)
    It seems those hackers missed the Philippines and accidentally hit the state department instead
  • Quick (Score:4, Funny)

    by WED Fan (911325) <(akahige) (at) (trashmail.net)> on Wednesday April 18, 2007 @10:58PM (#18793201) Homepage Journal
    Quick everyone, the bandwagon is getting ready to leave. Jump on.
  • Scary (Score:5, Insightful)

    by nicolas.kassis (875270) on Wednesday April 18, 2007 @11:01PM (#18793231)
    The fact that a simple Word document can cause such a big problem is really sad. How can you tell a few thousand of people not to open word document attachment? I mean, where I work, users receive tons of documents (pdf, office, autocad) files by email from vendors and such, I guess the only defense is good email filtering but still a 0-day attack would make that useless.

    • Re:Scary (Score:5, Insightful)

      by mrbluze (1034940) on Wednesday April 18, 2007 @11:45PM (#18793559) Journal

      The fact that a simple Word document can cause such a big problem is really sad. How can you tell a few thousand of people not to open word document attachment?

      Of course this is a popular article because it's more evidence of how Microsoft's 'professional' products are so amateurish, but you're right, you can't tell thousands of people not to open an attachment.

      The root of the problem doesn't lie in Word documents, or Word for Windows. The problem lies in Windows, period. The operating system is practically incapable of separating important and sensitive data from junk-mail and untrusted documents from the outside. In such a place as the State Department, it's scandalous.

      Whilst hypothetically, Linux is also vulnerable (eg: through some flaw in Open Office), a properly configured system could protect itself without needing to rely on the end user to manually screen every bit of junk they come across. Sure there would potentially have been some corruption of data, maybe some low level leakage, but really, this all points to a hopelessly overcomplicated and poorly designed OS. Naughty Bill!

      • Re: (Score:3, Interesting)

        It's interesting to note that the compromises on our machines don't occur on our terminal servers or the critical PC's, they only occur on the one's that "absolutely must have" administrative access on their local machine.

        A properly configured windows system is as secure as a properly configured linux system (well, in this case anyway!). And in case your wondering: If our helpdesk can't solve the issue within 15 minutes the PC is re-imaged no questions asked no data saved. People store stuff on network ser
        • Re:Scary (Score:5, Insightful)

          by ozmanjusri (601766) <aussie_bob@hotmai[ ]om ['l.c' in gap]> on Thursday April 19, 2007 @12:11AM (#18793793) Journal
          If our helpdesk can't solve the issue within 15 minutes the PC is re-imaged no questions asked no data saved.

          Christ on a stick! That's a bloody good reason to hide EVERY problem from the IT Nazis.

          Does anyone ever get any work done?

          • Re:Scary (Score:5, Interesting)

            by Architect_sasyr (938685) on Thursday April 19, 2007 @01:49AM (#18794393)
            Actually its a very effective method for both the IT team and the people who desperately need the administrative access. IT aren't required to understand every little john doe program that these people can want to install so they don't have to support them (this is very clearly communicated to these users).

            It also means that we have a relativly standardised form across the board despite having PC's everywhere and very quickly weed out the users who think they're smart but aren't really.

            An example of a good operator: there's a bloke over in administration who I would swear used to work in IT. He's got Open Office installed when everyone else uses Microsoft Office, he uses firefox, thunderbird and trillian for his messenger. About 500 theme packs and a few other bits of software. According to our helpdesk logging system he has only ever called once, and this was when he patched himself for the new daylight savings time last year. Everyone else had the problem as well.

            Also, so that those who aren't aware know, you don't have to be a local administrator to install a network printer. Anyone hooking a printer directly to a PC in a corporate environment is either a director or an IT who has lots to learn.
            • Re:Scary (Score:5, Insightful)

              by John Betonschaar (178617) on Thursday April 19, 2007 @04:02AM (#18795099)
              Actually its a very effective method for both the IT team and the people who desperately need the administrative access. IT aren't required to understand every little john doe program that these people can want to install so they don't have to support them (this is very clearly communicated to these users).

              [..]

              An example of a good operator: there's a bloke over in administration who I would swear used to work in IT. He's got Open Office installed when everyone else uses Microsoft Office, he uses firefox, thunderbird and trillian for his messenger. About 500 theme packs and a few other bits of software. According to our helpdesk logging system he has only ever called once, and this was when he patched himself for the new daylight savings time last year. Everyone else had the problem as well.


              I'd say that's a pretty stupid way to 'administer' your workstations... Why can these people even install all this shit themselves? How can some bloke in administration 'patch his machine' himself? And how does making them not call support because they know they won't fix your problem help with the maintenance of your network. The only thing I can see something like that heading to is an IT support department that only answers the utterly stupid requests and hardware failures. Employees just don't bother to call them because they don't want there machine re-imaged, so they just start fooling around themselves, or ask some guy like the 'bloke from administration' to 'fix' their system. Eventually that can only and in a maintenance and security nightmare.
          • Re: (Score:2, Interesting)

            by Raideen (975130)
            As the GP stated, "People store stuff on network servers because they're told to, anyone who doesn't comply with IT is made to suffer the consequences." Keeping data on the individual PCs is costly. In an environment that's setup properly (folder redirection at least, no write access to the hard drive outside of the home directory, maybe the addition of roaming profiles), there's no reason to worry about data stored on the local disk. If they re-image the machine and you still have issues, swap out the hard
          • by Phroggy (441)

            Christ on a stick! That's a bloody good reason to hide EVERY problem from the IT Nazis.

            Does anyone ever get any work done?
            Of course!

            The IT department gets LOTS of work done! Very efficient. :-D
          • Re: (Score:3, Insightful)

            by jimicus (737525)
            Christ on a stick! That's a bloody good reason to hide EVERY problem from the IT Nazis.

            Does anyone ever get any work done?


            Depending on your environment, that can actually be the quickest, easiest way to solve a problem.

            The GP didn't explain his environment, but in a lot of larger companies you'll find things are standardised as much as is humanly possible. In IT departments, "as much as is humanly possible" quite often isn't very much, so reimaging PCs there is a PITA for all concerned.

            But in a call centre
        • Re: (Score:2, Interesting)

          by tftp (111690)
          A properly configured windows system is as secure as a properly configured linux system

          It is also unmanageable by the operator. The IT does not have time to run around and help everyone when he needs to connect to a printer, for example, or install an approved, free or site-licensed piece of software. A simple XP user can't even change his own preferences in Word; a power user can't connect to a printer (but can install some software.) The XP privileges and their effects are as chaotic as they can be.

      • Re: (Score:3, Interesting)

        by dave1g (680091)
        actually you can. you just have to be hard core like the military. I work for a military contractor (a university research lab) we received an email telling us to not use word documents what so ever for a certain period of time. and if we didnt comply we lose our contracts. all attachments were being made in rich text format, some of the non techies were scrambling to figure out how to do it but life went on.

        not trying to excuse microsoft for their shitty product, just saying you can tell people to stop usi
        • Re: (Score:3, Funny)

          by Fred_A (10934)
          The dream of every sysadmin, to have that kind of power... Open a word file and you'll be fired. *sigh*
    • Re:Scary (Score:5, Insightful)

      by Sancho (17056) on Wednesday April 18, 2007 @11:52PM (#18793627) Homepage
      Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

      Furthermore, buffer overflows could exist in just about any program. There could be one in emacs right now, triggered by reading a file into the buffer. Then it would be "scary.. The fact that a simple text file can cause such a big problem is really sad."

      Unfortunately, they didn't disclose the nature of the vulnerability. "hidden software commands" in the mass media could be anything from shellcode to an executable embedded in the document, to a macro. Since Microsoft patched it, it was probably either something that autoran or an overflow.
      • Re:Scary (Score:5, Insightful)

        by jkrise (535370) on Thursday April 19, 2007 @12:58AM (#18794067) Journal
        Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

        Furthermore, buffer overflows could exist in just about any program. There could be one in emacs right now, triggered by reading a file into the buffer. Then it would be "scary.. The fact that a simple text file can cause such a big problem is really sad."


        Nice attempt to evade the issue by raking up redundant matters. The crux of the problem here is that MS Word needs or provides Internet access for some of it's functions. Even if it had any buffer overflows, the problem would not be exploitable from remote systems.

        The fact that Word is designed to occasionally talk over the internet coupled with it's hooks into the OS via things like VBA etc. is the problem. In fact, the main problem here is not Word or Office, it is the Windows architecture that is vulnerable.

        • Re:Scary (Score:5, Informative)

          by ArsenneLupin (766289) on Thursday April 19, 2007 @02:58AM (#18794771)

          The crux of the problem here is that MS Word needs or provides Internet access for some of it's functions. Even if it had any buffer overflows, the problem would not be exploitable from remote systems.
          Although Word does probably provide Internet access to its macros and other nasties, this was not a necessary condition for this to work. Even if MS Word didn't have any code within to connect to the internet, any supposed exploit would have been able to supply its own. And from the looks of it, this is what happen here. Apparently, this was some kind of call-back program that would somehow tunnel out through the firewall, connect to the hacker's control console and accept instructions from there.

          Such a thing is rather complex, and probably not pre-existing within word. It was brought in by the trojan itself.

          • by jkrise (535370)
            Apparently, this was 1. some kind of call-back program that would somehow tunnel out through the firewall, connect to the hacker's control console and accept instructions from there.

            Such a thing is rather complex, and probably not pre-existing within word. It was brought in by 2. the trojan itself.


            1. Excuse me... how would such a call-back program be initiated, and how would it perform the desired function? Does it not mean that Word has the provision / bug of being able to initiate external programs that
            • Re: (Score:3, Informative)

              by ArsenneLupin (766289)

              Excuse me... how would such a call-back program be initiated,

              "Shell code". Typically, a buffer overflow causes some user data (contained in Word document) to overwrite the stack, including the return address. The function in Word where this happened would thus not "return" to its intended spot (the caller), but rather to some other place in memory. This would be chosen by the attacker in such a way as to point to some place within the document. The document would contain machine-language code for the rest of the program (presumably, it would drop an exe somewhere, a

        • Nice attempt to evade the issue by raking up redundant matters. The crux of the problem here is that MS Word needs or provides Internet access for some of it's functions. Even if it had any buffer overflows, the problem would not be exploitable from remote systems.

          No, I'm afraid you're completely wrong. Word is not being exploited via "network-aware" functions. The exploits are Word .doc files with particular malformed elements. Nothing to do with networks except insofar as the booby-trapped documents are transmitted to the victim via email.

      • Re: (Score:2, Insightful)

        by wvmarle (1070040)

        Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

        Of course I don't. Nobody does. But the difference is, I wouldn't run a script like that when receiving it via e-mail, unless specifically requested from the sender. Word documents are another matter. I regularly (few times a week) get them unexpected, from unknown origin, and do open them. That is because I am expecting new sales/purchase leads from new customers/suppliers - that's part of my business. And often they send their info as ms word attachment. That said, I use Linux/OOo so not much risk open

      • by oGMo (379)

        Runing ./configure or make or make install could cause just as large a problem. Do you read through those scripts before running them?

        Running configure and make on a package from a "reputable" source is not the same as opening random documents people send you in an email. Or do you routinely have source packages mailed to you which you blindly build?

        I say "reputable" because while, in theory, you could download a source package from, say, sourceforge, that someone had trojaned, there are a number of f

        • This would be found quickly by users, reported, and removed from sourceforge in short order

          Why the conditional tense? Such things have already happened several times. And indeed, they've usually been located within days, but during that time, other people already have downloaded, built and run the trojaned packages.

          There are high odds that, if the piece of software you are using is generally usable and of wide appeal, there are a lot of other people who use it, and the maintainers are well-known (how many big open source projects are done anonymously?)

          What usually happens is that the distribution system is hacked, i.e. a third party somehow manages to slip a backdoor into a reputable program. Or maybe a minor contributor submits a "sneaky" patch that appears to fix a bug, but introduces another one using a well-placed typo. If thi

      • Do you read through those scripts before running them?

        Are you suggesting I don't read all my make install and ./configure scripts?

        I review my scripts for correctness every morning before I kick off my kernel recompile and take my shower.
      • by sumdumass (711423)
        Would a buffer overflow give a remote attacker control of the computer? Err let me rephrase that. Would a buffer overflow in emacs when opening a document in emacs give that document the power to notify a hacker it has done it's job and then give that hacker control of the computer with enough access to gain access to other information and retrieve it?

        I think the problem of having a problem is as bad as how easy and automated the problem can be. It isn't necessarily that a bug exist but what can be done wit
      • by donaldm (919619)
        > Running ./configure or make or make install could cause just as large a problem.
        > Do you read through those scripts before running them?

        Ok now we are getting into compiling source code and this is not what an normal user would do, even under Unix or Linux much less MS Windows. I can and do on occasions but normally try to get an "rpm" kit (Linux) but I can compile from source.

        On Linux/Unix when I get source I always work as a non privileged user (myself). First I read the README then after setting u
    • by DrSkwid (118965)
      > How can you tell a few thousand of people not to open word document attachment?

      Use an effective mail/document storage system.
  • by WhiteWolf666 (145211) <sherwin@nOsPaM.amiran.us> on Wednesday April 18, 2007 @11:04PM (#18793261) Homepage Journal
    Queue the legion of Microsoft apologists, saying things like:
    a) It's only because MS Office has the largest market share, this could of happened to any office suite!
    b) It's not a big deal, obviously the state department's IT department is incompetent.
    c) Damn Hackers, always trying to ruin a good thing!
    d) Macs run on Intel processors now, so they're vulnerable too!
    e) This is probably because the NSA sponsors SELinux.
    f) In Soviet Russia, MS Office hacks YOU!

    Did I miss any?
    • by rtb61 (674572)
      On the flip side, it would be very interesting to find out whether M$ already knew about this fault, and didn't warn anybody about it, to keep in line with the 'marketing and profits first', 'security and customer costs last' policy, remember in the M$=B$ universe, faults do not exist if they are not publicly declared and they couldn't be bothered patching them.
    • by jkrise (535370)
      Did I miss any?

      Yes. Imagine a Beowulf Cluster of MS shills and Apple fanboys... oh wait! Isn't that Slashdot already?
    • by Beefchief (808968) on Thursday April 19, 2007 @12:00AM (#18793709)
      g) Cue the Grammar Nazi that points out the difference between "cue" and "queue" :)
      • Re: (Score:2, Funny)

        h) And the one that points out could of != could've

        The first is a phrase that doesn't make sense, and the second is a contraction of "could have".
      • by lilomar (1072448)
        ---snip---
        cue 2 (kyoo) n. 1. A signal, such as a word or action, used to prompt another event in a performance, such as an actor's speech or entrance, a change in lighting, or a sound effect.
        ---snip---
        from http://www.thefreedictionary.com/cue [thefreedictionary.com]
    • Damn dude, leave some for the rest of us. Now how am I going to get my comment modded up?
    • Re: (Score:3, Interesting)

      by jimicus (737525)
      You joke, but I'd point out that a government department (particularly in a large, powerful country like the US) will always be a very attractive target - particularly for blackhats who know what they're doing rather than script kiddies.

      Yet the same government has politicians who are nobbled by Microsoft into saying that open source is less secure because anyone can look through it for security bugs.
    • Did I miss any?
      It's "could have" or "could've", not "could of", you insensitive clod!
  • by postbigbang (761081) on Wednesday April 18, 2007 @11:05PM (#18793263)
    1) the attack, once found, would have a bevy of coders working on it (we hope, of course)

    2) the testing and regression doesn't have the dependency matrix that Word does, and it's likely that if there was a link, it could be both understood and remedied quickly thru an open code supply chain

    3) multiple hackers (oops, I mean coders) would likely offer variances of a patch, of which perhaps several would/could be part of the subsequent 'patched' tree

    4) eight weeks is a travesty, and that the State Department of the United States of America didn't have an IDF that could detect the abberant traffic is just plain malfeasant. Heads should roll.
    • I'm not sure what IDF means but from TFA:

      The State Department detected its first break-in immediately, Reid said, and worked to block suspected communications with the hackers. But during its investigation, it discovered new break-ins at its Washington headquarters and other offices in eastern Asia, Reid said. At first, the hackers did not immediately appear to try stealing any U.S. government data. Authorities quietly monitored the hackers' activity, then tripwires severed Internet connections in the region after a limited amount of data was detected being stolen, Reid said.

  • Ahh, I remember the days when a virus spreading via email was just a silly joke [wikipedia.org] that everyone knew was impossible.

    Thanks Microsoft.

  • by drago177 (150148) on Wednesday April 18, 2007 @11:13PM (#18793313)
    At first, the hackers did not immediately appear to try stealing any U.S. government data. Authorities quietly monitored the hackers' activity, then tripwires severed Internet connections

    If you find evidence of a break-in, its possible the attackers are also connecting in a way you haven't yet detected. Hope they know what they're doing. Given their reputation, I doubt [slashdot.org] it [slashdot.org].
  • by djupedal (584558) on Wednesday April 18, 2007 @11:29PM (#18793437)
    "...then had to sever internet connectivity to avoid leaking too much data!"

    "Cap'n, we're having a wee bit 'o trouble in IT - we're leaking data down here like no one's bloody business - we may have to sever communications!"

    "Scottie - is it really that bad...? Isn't there some alternative that will buy us more time??!! I need more time, dammit man!"

    "Cap'n, I'm only a Star Fleet Engineer, not the Queen's magician..."

    "Well, Engineer...see if you can pull a rabbit out of your ass and buy me five more minutes before you cut us off. That's all we need to make the jump, and after that you can cut your nuts off for all I care!"

    "Aye, Cap'n...do me best - one shit-stained rabbit, com'n up - IT out!"
  • Anytime that applications are allowed to access files or capabilities beyond what is absolutely necessary to perform their function, there is a risk.

    Microsoft has created some of the most powerful office tools by leveraging tons of existing code that wasn't exactly designed for the intended purpose.

    For example, I love VBA (visual basic for applications)... it can make it very easy to turn a basic spreadsheet into a pseudo application. The problem is, VBA has too many ties to the OS.

    That's where "sane" oper
    • by goofballs (585077) on Wednesday April 18, 2007 @11:52PM (#18793631)

      That's where "sane" operating systems differ. User space and the OS are heavily separated, in fact, user space for each user is separated from other users, and almost all services run as a unique user. This intentional separation provides very robust security, and is absolutely necessary to creating a secure system. I cannot blame anyone but MS for this... and not the MS Word or Office team. If the OS were properly designed so that user space applications were properly separated, issues such as this would not exist.
      this has nothing to do with separation of the user space- the app is run as a unique user, and the information stolen is that available to that user. there is no suggestion that privilege escalation occured in this attack.
      • by jhfry (829244)
        The article was indeed light on details... but it suggested that once they had gained access to ONE machine via this document they were able to access data on the US Government network (I am assuming global network here). This tells me that whatever this document allowed granted the cracker access to more than what was on this user's computer, or even what this user was allowed to access.

        I cannot claim for certain that a similar exploit couldn't be done in a more secure, by design, operating system. Howev
        • by jimicus (737525)
          I cannot claim for certain that a similar exploit couldn't be done in a more secure, by design, operating system. However I suspect that it would be unlikely that you would find an operating system like Linux, OSX, Solaris, or AIX running a word processor application (or any productivity application) that can install a rootkit or other package allowing access to the local system (beyond the current user's rights), let alone the network. Such a design would be "insecure" and not tolerated by the community.

          Th
    • by Mr 44 (180750) on Thursday April 19, 2007 @12:53AM (#18794039)
      Wheres the -1, Misinformed?

      That's where "sane" operating systems differ. User space and the OS are heavily separated, in fact, user space for each user is separated from other users, and almost all services run as a unique user. This intentional separation provides very robust security, and is absolutely necessary to creating a secure system.

      Are you implying that is not the case with windows??? A quick look in task manager shows some system processes running as your user account, some as "LOCAL SERVICE", some as "NETWORK SERVICE", (both restricted accounts) and some as "SYSTEM" (=root). And a quick look at top on my linux box sure doesn't show "almost all" services running as unique users.

      And sure, its up to the administrator to configure it so the user account is not an administrator, but I've never seen a government system where a domain user account has local admin rights.

      In the specific case of this vulnerability, the word document was able to run arbitrary executable code as the current user. This presumably allowed access to network shares, and then sending the data back out (via HTTP most likely). That sort of thing would be possible with any operating system.

      The only area you are correct in is that on linux the flaw could be patched quicker... But in a large organization, it likely could still be preferable to block the exploit with IDS/firewall rules than by rolling out a client patch...
  • Opendoc (Score:3, Interesting)

    by Billly Gates (198444) on Wednesday April 18, 2007 @11:45PM (#18793561) Journal
    Well its a good thing the government standardizes on opendoc and does not cater to special interests like Microsofts lobbiests when making requirements for secure workstations.
  • by tymbow (725036) on Wednesday April 18, 2007 @11:49PM (#18793601)
    I had an interesting discussion the other day with some colleagues and we came to a consensus that many Microsoft products were and still are, or at least inherit, a design philosophy similar to that of the Internet when it was first created. The Internet was built on a basis of implied trust and as we have seen in present times, particularly with e-mail and the SMTP protocol, this model of design is a poor foundation. To counter these issues we need to design more and cleverer countermeasures in an escalating war with miscreants; a parallel we also see in Microsoft products with never ending cycle of Anti-Virus and Anti-Spyware updates and patches required to deal with both programming flaws are poor design choices that assumed trust (recall the ILOVEYOU debacle). The real kicker is that you could argue that many of the problems we now face on the Internet are largely due to poor design in Microsoft software which as I noted parallels an original design methodology of the Internet. We've had several articles earlier in the week pushing a view that the Internet needed to be re-architected due to its flawed security design (although I think it's more about commerce and control but I won't go there for now) - is it not also time to re-architect Microsoft and their approach to developing products? Would we even have these problems if not for Microsoft? My two cents.
  • ...rigged Excel spread sheet that wires money to ElQaida yet... ;)
  • by cunina (986893) on Thursday April 19, 2007 @12:00AM (#18793703)
    ...knowing that your products were banned from the State Department for some theoretical and highly unlikely exploit, while Microsoft Word continues to be used there despite a documented (no pun intended) security breach attributed to it.
  • by secPM_MS (1081961) on Thursday April 19, 2007 @12:10AM (#18793791)
    It is easy to condemn Microsoft for the vulnerabilities in Office, but the root issue here is the rich functionality in modern office suites. Office came to dominate the market by its rich functionality, tight integration, and ease of use. The addition of sophisticated scripting functionality allowed organizations or integrators to add yet more value. It also created a fertile environment for malicious attackers. As long as the Windows operating system was easily broken, nobody bothered much with attacking the application stack. As Microsoft has raised the bar in the attack resistance of the operating system, attacks have moved up the stack. I was not at MS at the time, but I do not believe that security has at the top of the stack for Office 11 and earlier. I do know that substantial hardening was performed on Office 12, which I believe is now marketed as Office 2007. From my point of view, Office 12 should be viewed as a very important security update to Office 11. I know, they changed the UI. I wish they had left a "classic" option. They didn't. But Office 12 is far less vulnerable than Office 11.

    In their determination to sucessfully match Office's rich features, Open Office has acquired similar vulnerabilities. One evaluation I saw some time ago concluded that Open Office was likely to be more vulnerable than Office.

    If you want to be secure, run software that does what you need, and NO MORE! Rich functionality and extensibility are the attack points. Not many people want to restrict themelves to txt files or filtered html, let alone edit any longer with editors such as vi or microemacs. Due to their extensibility, pdf and postscript are suspect in the eyes of the truly paranoid, let alone the complex modern formats.

  • Well in my office (Score:4, Insightful)

    by th3rmite (938737) on Thursday April 19, 2007 @01:00AM (#18794081)
    Most people who are not familiar with IT in the US Government have NO IDEA how dependent even the military is on MS products. Think MS based virii, worms and exploits aren't on classified networks? Networks that don't even share a common hardware link to the internet...
  • oh good lord (Score:2, Interesting)

    Thank god there are no file sharing users/security risks at the State Department. It's better to populate an important governmental agency with drones as opposed to internet savvy employees who can't assist network administrators by giving them a slightly more informed heads up regarding odd or bizarre 'puter goings-ons. I hate my own sarcasm. Hate it.
  • According to MS, this is the normal course of operation. [slashdot.org]
  • by MulluskO (305219) on Thursday April 19, 2007 @01:46AM (#18794375) Journal
    A sane email policy blocks executable files and archives containing executables, but allowing dot docs in is probably unavoidable.

    I wonder then, if it might be possible to scan a Word document for stuff that's not needed. Treat all dot docs that have VB in them as executables and block them out. You might go so far as to attempt intelligent analysis of the document to make sure it consists only of code that would reasonably be generated by a human being. Perform sanity checks on certain variables and so on.
  • If they needed to completely drop all internet access, it shows how poorly organised their internet services were.

    Most people under similar circumstances would simply upgrade their firewall ruleset and if necessary adopt alternate internal policies to allow limited connection to the internet during the crisis - especially given that it was indicated that the problems dropping the internet connection caused was significant.

    Simply unplugging the pipe to circumvent an internal threat is like turning the power
    • If they needed to completely drop all internet access, it shows how poorly organised their internet services were.

      The IT guys at my work do that to, but all they really need to do is strip off everything except text/plain. At least that way we could keep working. They probably think emailing word documents to each other is normal and can't imagine not having it.

  • hacker != criminal (Score:3, Insightful)

    by tomstdenis (446163) <tomstdenisNO@SPAMgmail.com> on Thursday April 19, 2007 @06:51AM (#18795823) Homepage
    -1 for subby for using the word "hacker" to describe the criminal(s) responsible. You'd think the /. crowd would know better.

    Tom
  • Puzzled ... (Score:3, Funny)

    by jc42 (318812) on Thursday April 19, 2007 @05:02PM (#18805031) Homepage Journal
    Why in the world would anyone with security concerns (and even the tiniest amount of sense ;-) allow the use of Word or any other proprietary, binary format, in email?

    A fun example: A couple of years ago, a fellow hereabouts told the local linux/unix user group a funny story of how Word docs got banned at his workplace. It seems that a VP had written some missive, and decided that it was so important that everyone in the company would want to read it. So he mailed it out to everyone. It was a Word doc, and the people with unix-type workstations mostly couldn't read it, so they did the obvious thing. They fed it to the strings(1) command. The result of this isn't pretty, since it loses all the (binary) formatting and font markup, but the text was readable.

    However, strings can't decode the binary stuff, and didn't know to honor the "deleted" tags on big chunks of the file. It seems that among the deleted stuff was a list of the salaries of most of the management. Ooops!

    The unix users got a bit of a chuckle out of this, of course, and the news got back to the VP (and other managers) what he'd mailed out. After the inevitable finger pointing settled down, the message got through the mangers' thick skulls that Word docs can and usually do contain "deleted" stuff that hasn't actually been removed or blanked out, and any time they send someone a Word doc, they might be sending them pieces of any other Word doc that has ever been on their computer. And it's not just unix users who can read this "deleted" stuff; a clever programmer could fairly easily make it visible on Microsoft systems, too. You could just port the strings command to Windows.

    So the word came down that Word docs were strictly forbidden in email. Especially email sent outside the company.

    This problem is not exactly secret. Any organization that allows Word docs, or any other proprietary binary format, in emails is inviting exactly this same sort of problem. Even if you don't understand it or believe it, chances are that some of your competitors do.

    It's especially astonishing that the US State Department would allow Word docs to be emailed. Don't they have any competent security people at all?

    (Or maybe they do, but they are intentionally ignoring the advice of such people. That does seem to be how the US government works these days. ;-)

Building translators is good clean fun. -- T. Cheatham

Working...