07.12.08

Taking Microsoft OOXML to Task

Posted in ISO, Microsoft, Open XML, OpenDocument, Security at 2:13 pm by Dr. Roy Schestowitz

Any Windows/Office debuggers in the audience?

The following is a reproduction of a new post from Rex Ballard (I started this discussion thread), whose previous post we quoted the other day.


Message-ID: <31a66169-d9e7-4715-9e9e-e3488ebd36a9@25g2000hsx.googlegroups.com>
From: Rex Ballard <rex.ballard@gmail.com>
Newsgroups: comp.os.linux.advocacy
Subject: Re: Leaked ISO Document Reveals Crooked ISO Amid MS OOXML Corruptions
Date: Sat, 12 Jul 2008 08:20:23 -0700 (PDT)

[...]

ODF is a comprehensive document that provides detailed specifications
from the high level document content down to the smallest elements of
scalable vector graphics. There are some “standard” mime object types
that are supported, such as PNG and JPEG, but other embedded formats
must be installed using plug-ins which have to be authenticated by the
user and by the system at installation time, and cannot be installed
by the content. Furthermore, the installed content can easily be
identified as trustworthy or not, and can be restricted in it’s
capabilities.

OpenXML on the other hand, is a high-level specification which
describes the high level envelopes used to embed binary objects which
are included in the content. The content itself contains the binary
code which can call any function in any Microsoft library and has all
permissions of the person opening the document. If a user account is
set up as “Administrator”, then the application can mess with the
registry, create, download, and hide files, can execute applications
in those files, can install any number of new viruses, and generally
wreak havoc on the system.

I’ll leave it to others to document the exact details (as I said, I’m
busy these days), but I’m sure anyone who tries to publish these
vulnerabilites will probably find themselves getting the same
treatment that Tracy Reed of Ultraviolet.org got when he tried to
publish his warnings about ActiveX controls back in 1997. Microsoft
got a court injunction against him, and forced him to take down the
content, claiming that it was being used to encourage hacking, and was
damaging the Microsoft brand.

“I got a couple of docx documents and had trouble getting them to open, even with the plug-in for Office XP. Next thing I know, I get a notice from my registry auditor that I have 1300 new registry errors.”Over the last 10 years,
we’ve seen these very same
techniques, documented back in 1997,
used widely to spread viruses including
Melissa, Nimda, Sky, BugBear, and about
250,000 other viruses, worms,
and malware, not including spy-ware and
other “Microsoft Authorized”
invasions of our privacy.

I got a couple of docx documents and had trouble getting them to open,
even with the plug-in for Office XP. Next thing I know, I get a
notice from my registry auditor that I have 1300 new registry errors.
And suddenly, my PC is churning the disk-drive and the network
connection at 3:00 AM (I’m getting old and have to get up), and the
network shows that I’m uploading something at full speed, even though
my computer is supposedly sleeping.

It isn’t a back-up program that I’m running.

I would encourage COLA readers and OSS advocates to explore this in
more detail.

get someone with Office 2007 to send you a docx file.
unzip it using pkzip or winzip or unzip.

look at the binary files.

replace one binary object with another.

zip up the document,

see if your office-2007 user can read the “enhanced” document.

For those of you with OLE programming skills, create an OLE object
that creates a file, and e-mails that file to you using smtp.

Send a document with this new ole object embedded (along with the
others) and see if you get an e-mail.

I haven’t tried this, and I don’t know if it will work. I’m not sure
how hard it would be to make it work. I just think it might be an
interesting project worth investigating, especially if you are
considering the migration of a few thousand users to Vista and Office
2007.

I’d love to see what the results turn out to be. After all, if it’s
that easy to take control of a recipient’s machine just by sending
them a “trusted” Word, Excel, or PowerPoint attachment, just think how
much chaos a really aggressive malicious hacker, with a goal of
obtaining marketable information about your business, could do.


Does ISO really want to approve such a ‘virus’? As an international standard even? If someone tests the above, please post the outcome here or elsewhere. It would prove invaluable.

The last time a chain of ISO problems was cited, Ian Easson challenged an argument from Groklaw. He might wish read the following lengthy follow-up. ISO is in a deeper puddle of mud than before.

Brazil is a P member of SC 34, so according to my reading of the clause, it has the right to appeal if any of the three above issues apply, and arguably they all do. According to South Africa, if the issue is ISO’s reputation, or if there is a matter of principle involved, Brazil can appeal. Even point three could apply, in that Brazil raises matters such as incorrect tabulation of votes, which, if true, one would hope ISO wasn’t aware of.

[...]

Why did they bother to go, one might ask? Why vote, if votes disappear from the record? By my reading, Brazil paints a picture of an orchestrated event, tilted away from criticism or a negative result and a refusal to give substantive consideration to issues delegates wanted to discuss, due to time constraints Brazil calls arbitrary, and worse.

For details about the BRM in question, see [1, 2, 3, 4, 5, 6, 7, 8] and have your jaw sink to the floor. It was a bad plan from the get-go [1, 2, 3, 4, 5], but Emperor Microsoft was in a hurry and it even used its lobbyist Jan Van Den Beld to change the rules ‘on the fly’.

OOXML protests in India
From the Campaign for Document Freedom

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. IRC Proceedings: Saturday, January 23, 2021

    IRC logs for Saturday, January 23, 2021



  2. Links 24/1/2021: Nouveau X.Org Driver Release and GhostBSD 21.01.20

    Links for the day



  3. InteLeaks – Part XXX: Harbor Research's Pseudo-scientific 'Research' for Intel, Bizarrely Suggesting a Microsoft Partnership for a Domain Largely Controlled or Dominated by Linux

    The full document that Intel paid for and in turn used to justify cracking down on Free software (obliterating Free software-based workflows inside Intel), instead outsourcing all sorts of things to proprietary software traps of Microsoft



  4. Chromium and Chrome Are Not Free Software But an Example of Microsoft-Fashioned Openwashing Tactics

    It's time to reject Google's Web monopoly (shared with other companies but still an oligopoly); removing its Web browser would be a good start



  5. Links 23/1/2021: Chromium Pains and New Debian Maintainers

    Links for the day



  6. InteLeaks – Part XXIX: Harbor Research Did Not Produce a Study But an Elaborate Hoax for Intel, Suggesting Microsoft Partnership and Outsourcing Based on Zero Evidence and No Solid Rationale

    The pseudo-scientific ‘report’ from Harbor Research is more of the same nonsense we’ve grown accustomed to; unethical if not rogue firms are being paid to lie — or to perpetuate falsehoods which someone stands to gain from



  7. Video: The State of Communities Surrounding GNU/Linux Distributions

    A discussion about the state of volunteer efforts going into the development, maintenance (in the 'maintainership' sense) and support/advocacy of GNU/Linux distros



  8. IRC Proceedings: Friday, January 22, 2021

    IRC logs for Friday, January 22, 2021



  9. InteLeaks – Part XXVIII: Intel Served Report From Microsoft Boosters, Who Provide No Actual Evidence and No Science to Back Their Supposed 'Findings'

    Findings and recommendations from Harbor 'Research' aren't based on any scientific methods, just perceived loyalty, branding, and a bunch of unsourced quotes (from unnamed people with ridiculous job titles like a soup of buzzwords)



  10. Erosion of Communities, Ascent of Corporate-Industrial Fake Communities

    Despite the attempts to manipulate/trick developers (and sometimes users) into becoming unpaid workforce of for-profit companies, there's an exodus back to real communities, which aren't subjected to the fury of wealthy shareholders who utterly dislike or simply don't care for software freedom



  11. The Corporate 'Left' and the Open Source Pseudo 'Movement'

    President Biden may not be as bad as his predecessor, but that hardly means very much; software freedom is still threatened, along with many other things



  12. Links 22/1/2021: pfSense Plus, Endless OS Foundation, and Many Laptops With GNU/Linux

    Links for the day



  13. The Linux Foundation is Trying to Obscure Racism Using Microsoft-Inspired Tactics (Vouchers Disguised as Actual Money)

    The Linux Foundation and its PR stunts don’t help combat racism; one might argue that the Foundation is leveraging racism, which prevails in the US, to paint itself as benevolent and caring (offering immaterial things and self-serving press releases)



  14. InteLeaks – Part XXVII: 'Pulling a Nokia' on Intel (Outsourcing to Microsoft)

    The recommendation of an Intel marriage with Microsoft (even in units that deal mostly with Linux) is an insulting slap across the face of developers employed there; we take a look at recommendations made to IoTG (Intel) by a firm with Microsoft orientation



  15. IRC Proceedings: Thursday, January 21, 2021

    IRC logs for Thursday, January 21, 2021



  16. InteLeaks – Part XXVI: Harbor Research is Horrible 'Research', Lacking Actual Technical Background

    Having looked at the members of staff of Harbor Research (individually), it seems clearer now why they have an affinity for Microsoft and why they're directing Intel to liaise with Microsoft and become a prisoner of Microsoft (even in areas where Microsoft is increasingly irrelevant)



  17. Links 21/1/2021: Raspberry Pi Pico, Ubuntu 21.04 Picks GNOME 3.38, KDE Plasma 5.21 Beta

    Links for the day



  18. How a Newly Inaugurated President Biden Can Advance Software Freedom (If He Actually Wishes to Do So)

    Techrights has 'Four Suggestions' to President Biden, the 46th 'front end' of American plutocracy



  19. InteLeaks – Part XXV: Intel's Brain Drain Leads to Unusual Measures

    As the company once known as 'chipzilla' loses its relevance and dominance in the market it's reaching out to retired people, trying to get them back onboard



  20. Hey Hi (AI) is Just a Trojan Horse for Illegal Software Patents, According to EPO Management and Litigation Firms It's in Bed With

    The longtime pushers or the lobby of patent profiteers just carry on pushing for software patents, nowadays latching onto the inane and unwarranted media hype around Hey Hi (AI) — a hype wave that was co-opted by EPO management to grant unlawful patents



  21. The Central Staff Representatives (CSC) of the EPO Are Petitioning to End the Assault on EPO Staff

    The EPO, just one month after the staff went on strike, is about to receive a compelling petition to stop the assault on EPO staff



  22. InteLeaks – Part XXIV: Love for Microsoft, Not for Free Software or Whatever Replaces Microsoft

    Intel is basing its big decisions on buzzwords and firms that master buzzwords; it's sad that instead of listening to Intel's own (in-house) engineers it's relying on a bunch of clowns who push 'Clown Computing' and 'apps' and 'UX'...



  23. IRC Proceedings: Wednesday, January 20, 2021

    IRC logs for Wednesday, January 20, 2021



  24. Links 21/1/2021: Google Tightens the Screws on Chromium, VideoLAN VLC 3.0.12

    Links for the day



  25. IBM Panics and Resorts to 'Customer Retention' Tactics With Red Hat Enterprise Linux (RHEL)

    IBM 'frees' RHEL but with limitations that can restrict growth of small companies (or subject them to financial barriers, originally unforeseen)



  26. Recent Techrights Articles About President Joe Biden

    Instead of writing yet more stuff about the latest US president, let's look back at what we wrote in recent weeks/months



  27. Links 20/1/2021: LibreOffice 7.1 RC2 and the RHEL Contingency

    Links for the day



  28. InteLeaks – Part XXIII: Intel Paying for Bogus 'Research' 'Insights' Which Merely Seek to Justify Outsourcing to Microsoft and Imposing Microsoft's Proprietary Software on Free Software Developers

    Intel's preference for Microsoft monopoly (an imposed/top-down decision) was seemingly certified by so-called 'consultants' and 'analysts' from the outside rather than the inside, basically manufacturing a false perception of consent after managers had already made up their minds



  29. Suppressed Facts of the Free Software Movement and Its Community of Volunteers – Part V: How FSF Secrecy Ended Up Insulting People, Alienating Trans Developers

    Having just uploaded this introductory video, we delve into the backstory or the real reason the FSF sank into somewhat of a crisis with the trans community almost half a decade ago



  30. InteLeaks – Part XXII: Bubbles and Buzzwords, No Substance at Intel's Internet of Things (IoT) Group (IOTG)

    The video above is continuation of the previous part about a document full of superficial buzzwords (not technical jargon anywhere), in effect recommending to managers that they blindly follow trends and cargo cults (such as Clown Computing) and not what’s most suitable for technical excellence


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts