Bonum Certa Men Certa

Confirmed: Microsoft OOXML a Security Hazard

flickr:2400867976



SEVERAL MONTHS ago we warned that OOXML is not secure. Its dependence on a particular platform and office suite rendered it insecure by design just like those 'origin' formats, namely binaries, which it merely shuffled around (reassembled).



It is now official and also confirmed that OOXML files are not just insecure but there are also persistent attacks against new flaws (without any security patches being available, i.e. zero-day). To quote one of the more recent reports:

Some Open XML based products as Microsoft Excel are affected by a security flaw and the Trojan.Mdropper.AC.


There is fairly wide coverage of this problem, e.g. in:



Microsoft's Excel spreadsheet program has a 0-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec.

A 0-day vulnerability is one that does not have a patch and is actively being used to attack computers when it is publicly revealed.


Heise Online calls this vulnerability "critical" (highest level of severity by another one Microsoft's 'standards').

According to unconfirmed reports, the anti-virus manufacturer Symantec has found a trojan that seems to use a security hole in Microsoft Excel to remotely execute code on a user's system. The attack is triggered by opening a maliciously crafted Excel file, causing an unspecified remote code-execution vulnerability.


One reader points out that "Microsoft is continuing its war against a universal office format.

"Notice in particular: 'will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System'

"What kind of hell is this causing in agencies, big businesses and schools? It's not like they don't have or could live with out the terabytes of electronic records now locked out by the kludge outlined above."

Such problems could first be seen a year ago when Microsoft's OOXML crimes were still prevalent. To make matters worse, Microsoft will continue to drift further away from ECMA OOXML, probably to gravitate in its own proprietary direction. Office 14, for example, is not committed to any real standards and according to yesterday's report from Mary Jo Foley, it's already delayed anyway.

Ballmer: Office 14 not this year



[...]

However, last year, more than a few times execs slipped up and indicated Office 14 would ship in 2009.


Things are not working well for Redmond these days. For real profit, Microsoft is highly dependent on Office which is its most profitable product (and one of the few that are actually profitable). Unless Microsoft can reinforce planned obsolescence and convince people to buy an upgrade they do not need, there's great trouble ahead. The economic meltdown does not help.

OpenOffice.org makes a remarkably familiar substitute and Google Apps, among other SaaS alternatives, gain momentum despite the slew of disinformation from former Microsoft employees (masquerading as research firms).

Recent Techrights' Posts

It's Cheaper to Pay Bribes (and Produce Press Releases) Than to Pay Fines (After Lots of Negative Publicity)
Does the UK still have real sovereignty or do corporations from overseas purchase decisions and outcomes?
November 2023 Over With GNU/Linux at All-Time Highs According to statCounter
ChromeOS+GNU/Linux combined are about 7% of the "market"
 
Links 01/12/2023: Facebook Infested With Malicious Campaigns by Imposters, ACLU Gives Advice on Doxxing and Online Harassment
Links for the day
Just Like Its Budget Allocation, the Linux Foundation Devotes About 3% Of Its Latest Newsletter to Linux, Devotes More to Linux's Rivals
It's just exploiting the brand
Links 01/12/2023: Google Invokes Antitrust Against Microsoft
Links for the day
Over at Tux Machines...
GNU/Linux news
UK Government Allowing Microsoft to Take Over Activision Blizzard Will Destroy Jobs
Over 30,000 fired this year? More?
New Report Provides Numerical Evidence That Google Hired Too Many People From Microsoft (and Became Malicious, Evil, Sociopathic)
"Some 12,018 former Microsoft employees currently work for the search and data giant"
Google: Keep Out, Don't Save Your Files, and Also Let Us Spy on Everything You Do
Do you still trust "clown" storage?
IRC Proceedings: Thursday, November 30, 2023
IRC logs for Thursday, November 30, 2023
Links 01/12/2023: Many Suppressions in Hong Kong and Attempts to Legitimise Illegal and Unconstitutional Fake Patent 'Court' in EU (UPC)
Links for the day
Gemini Not Deflated Yet (Soon Turning 5!)
Gemini numbers still moving up, the protocol will turn five next summer
Links 30/11/2023: Belated End of Henry Kissinger and 'Popular Science' Shuts Online Magazine
Links for the day
Site Priorities and Upcoming Improvements
pages are served very fast
[Meme] One Person, Singular Pronoun
Abusing people into abusing the English language is very poor diplomacy
Ending Software Patents in Recent Years (Software Freedom Fighters MIA)
not a resolved issue
New Article From Richard Stallman Explains Why He Says He and She for Unknown Person (Not 'They')
"Nowadays I use gender-neutral singular pronouns for a person whose gender I don't know"
IRC Proceedings: Wednesday, November 29, 2023
IRC logs for Wednesday, November 29, 2023
Over at Tux Machines...
GNU/Linux news
Links 30/11/2023: Rushing Patent Cases With Shorter Trial Scheme (STS), Sanctions Not Working
Links for the day
Links 30/11/2023: Google Purging Many Accounts and Content (to Save Money), Finland Fully Seals Border With Russia
Links for the day
Lookout, It's Outlook
Outlook is all about the sharing!
Updated A Month Ago: Richard Stallman on Software Patents as Obstacles to Software Development
very recent update
The 'Smart' Attack on Power Grid Neutrality (or the Wet Dream of Tiered Pricing for Power, Essentially Punishing Poorer Households for Exercising Freedom Like Richer Households)
The dishonest marketing people tell us the age of disservice and discrimination is all about "smart" and "Hey Hi" (AI) as in algorithms akin to traffic-shaping in the context of network neutrality
Links 29/11/2023: VMware Layoffs and Too Many Microsofters Going Inside Google
Links for the day
Is BlueMail a Client of ZDNet Now?
Let's examine what BlueMail does to promote itself
Just What LINUX.COM Needed After Over a Month of Inactivity: SPAM SPAM SPAM (Linux Brand as a Spamfarm)
It's not even about Linux
Microsoft “Discriminated Based on Sexuality”
Relevant, as they love lecturing us on "diversity" and "inclusion"...
IRC Proceedings: Tuesday, November 28, 2023
IRC logs for Tuesday, November 28, 2023