OpenOffice.org virus debunked by experts (NewsForge)

Posted Jun 2, 2006 23:48 UTC (Fri) by arcticwolf (guest, #8341) [Link]

That statement makes about as much sense as saying "Viri is a known risk with any capable operating system. This 'proof of concept' virus is not new information, and does not require a software patch."

There's a kernel of truth in there, of course, but basically just saying "there's nothing we can do to completely get rid of viri, so we're not even gonna try to make it more difficult for them" is stupid.

F-Secure has a blog entry on this, BTW: http://www.f-secure.com/weblog/#00000893

Posted Jun 3, 2006 8:28 UTC (Sat) by jdv (subscriber, #712) [Link]

I can understand that macro's can be very useful, but allowing them to write outside the space where they live is a very different thing from having macro's in the first place. It is not enough to just have a warning that a document contains macro's, at the very least you want a user to take some explicit /separate/ action to allow the macro to do things that could harm the rest of the system.

If this is 'Industry best practice', the industry is stupid.

Posted Jun 5, 2006 12:42 UTC (Mon) by ledow (guest, #11753) [Link]

As others have stated, macro languages have their uses but where, in any document, at any time, do you ever really *need* to play about (i.e. write)with other files? And if you do, why on Earth are you not using something DESIGNED for the job, not bolted on to a word processor. People now have to assume that Word + WordBASIC is a full development environment with full programming capabilities because it has commands that can do dangerous things (remove files, add data to files, execute ActiveX controls etc.). Even I can remember writing a Word macro to bypass my schools Windows 3.1 network and allow me to run programs I wouldn't normally be able to. That was nearly 15 years ago and we're still making the same mistakes. Why couldn't a macro just be limited to a safe subset of commands? Anything else is a job for a real language, with real programmers taking care over what they do, removing user-error and making sure that any auto-execution of such code is carefully controlled.

You want to automate a mail-merge? You don't need powerful macros. You want to create customised forms with internet-feedback? You still don't need powerful macros. But if you're going to be playing about with people's abitrary files, removing them, adding data to them, loading ActiveX controls, you're using the wrong tool for the job.

Word macros also cause nothing but problems for system administrators. More and more programs are using them to achieve their ends (I work in a primary school and can cite RM Talking First Word and Nelson Handwriting Font as two wonderful examples of bad programming - the latter is just a font and a Word template but DEMANDS full macro access, which we can't expect the kids to click Yes/No to every time [we are hoping the kids will then STOP and ASK if something DOES pop up - it works too], and for which there is no secure certificate/signature, thus DEMANDING that all macros are enabled site-wide. For a program that lets you type in text and have it appear in a curly-handwritten font! Let's just say that the time-to-bin was remarkably short with that one).

Word macros allow all sorts of bypasses on which programs people can run, what they can do with them, effecively provided a "Run" dialog inside a standard piece of office software. Why? If you want to automate office tasks, you should be using some external "office macro" program, that is associated with a particular mime filetype, bundled with the office suite. You should NOT be integrating them into documents.

The major indicators of a virus are, IMO:

1) Something that replicates without direct human assistance to other machines.
2) Something that does damage (including infecting other files).

Why do macro capabilities require anything that allows a program running in such an environment to transfer itself somewhere else, such as to other local documents, network locations etc.? A macro should not be writing macros into other files, damaging existing files, stripping email addresses etc. Surely a macro that DOES interfere with other files should be intercepted and have warnings posted anyway (most macros I've seen in my use of Word/Excel are for things like print buttons, automated calculations, moving to extra sheets conveniently, fitting in strange fonts with correct ligatures etc.)?

"The macros within this document are trying to save data to /path/filename. Allow Y/N/All?"

But the vital point is that macros don't need to have integration capabilities with the operating system to be useful - a small subset of formulae and facilities that, by their own quantity, limit the scope of what's possible in a document is sufficient.

OpenOffice should not be following the crowd on this one. We all know that everyone clicks Yes (hence popups, spyware, macro viruses, email spam, IM spam, phishing scams and lots of other nasties) so we should take out the possibility of them saying yes to something dangerous without REALLY, REALLY being certain of the consequences. This means that anything REMOTELY dangerous should not be included in a macro language that's going to be bundled in a Word processor. Most people don't even know what a macro IS, let alone what it's capable of if you click Yes.

Cut the macro language down to non-damaging statements only. You can allow automatic execution of any document that DOES NOT contain a single damaging command (though you should still keep up with updates just in case someone finds a hole somewhere). Damaging statements (if included at all) should present LARGE, obnoxious red warnings to tell you that, should you click yes, your computer is in the hands of the programmer of that document. Make them annoying as hell, log their actions ("You got a virus? Ah, yes, you clicked yes to this emailled .DOC file, didn't you? We'll put the cleanup cost on your department budget"), do everything to make sure that the user gets annoyed and them and complains to the author for not doing it safely. Macros should ALWAYS be signed by something approaching a PGP key (if not, they should never execute). All documents so signed will only be executed if they match a "safelist" of specific signatures for documents (i.e. the IT department's PGP key). Anything else should be denied/deleted.

"Legacy" document macros should be phased out or people will JUST KEEP USING THEM and, in fact, produce more and more dangerous facilities into their macro languages. We soon learned (as if we didn't all know) that .exe attachments are dangerous. Autorun on removeable devices is a silly idea that other operating systems are deliberately not following. We all learned that opening macro documents from untrusted users is stupid. When are we going to learn that if the capability isn't there, peple can't use it?

Stop people being required, asked, prompted, encouraged or even able to execute abitrary code in their day-to-day tasks.