LWN: Comments on "Macro virus for Staroffice discovered (Techworld)"

Macro virus for Staroffice discovered (Techworld)

Wol — Thu, 01 Jun 2006 08:22:52 +0000

Why not just do it the WordPerfect way?

AIUI, PerfectScript viruses are impossible. WordPerfect, despite having a pretty decent macro language, was immune to viruses until they licenced MS's VBA engine. And provided that engine isn't enabled, it's still immune :-)

Cheers,
Wol

Macro virus for Staroffice discovered (Techworld)

Arker — Thu, 01 Jun 2006 04:03:20 +0000

Exactly.

Expect more of this, not less, in the future, as so much FOSS 'desktop' software imitates bad proprietary software.

Macro virus for Staroffice discovered (Techworld)

dwheeler — Thu, 01 Jun 2006 04:01:18 +0000

ODF has some program-like capabilities defined (e.g., for graphs), but they are all strictly limited. The way the ODF spec is designed, I doubt there is a requirement that makes it impossible to be secure.

Macro virus for Staroffice discovered (Techworld)

Ross — Thu, 01 Jun 2006 01:02:10 +0000

If the format dictates when the macro is executed and what it can do, it affects the security. That's my point. Otherwise it's an application bug/feature.

Macro virus for Staroffice discovered (Techworld)

jhardin — Thu, 01 Jun 2006 00:35:03 +0000

> ... a fundamental weakness in the file format where, like with MS Office files, macros are allowed to ...

What does the file format have to do with what macros are or are not allowed to do? The file format only stores the data; it's the *application* that supports a macro language, and allows it to run amok.

Macro virus for Staroffice discovered (Techworld)

Ross — Wed, 31 May 2006 21:34:46 +0000

That would only work if it is taking advantage of a bug in a particular implementation. It could be (I have no idea) that there is a fundamental weakness in the file format where, like with MS Office files, macros are allowed to edit other files without prompting the user (the startup prompt is mostly useless because people get used to saying "Yes" on every file they open).

Macro virus for Staroffice discovered (Techworld)

dwheeler — Wed, 31 May 2006 18:48:16 +0000

I see no evidence that this virus can attack current systems. But if it could, one solution to virus propagation is diversity. If there were multiple ODF readers, it was reasonable for users to pick any one of them, and there was a virus attack that worked against one, it's less likely to work against others.

Oh look, there are multiple implementations, and the format is designed to encourage multiple interoperable implementations. Looks like ODF is the solution, not the problem.

Macro virus for Staroffice discovered (Techworld)

MortFurd — Wed, 31 May 2006 14:51:25 +0000

Heise in Germany reported on the same "virus" and mentioned that Stardust only runs on StarOffice 5.

StarOffice 8 is based on OOo 2, and StarOffice 7 was based on OOo 1. StarOffice 5 was out years ago. It was on the SuSE 6.2 CDs so many years ago when I switched from Windows 95 to SuSE 6.2.

Heise does mention that Stardust could easily be ported to OOo 2, however.

Macro virus for Staroffice discovered (Techworld)

grouch — Wed, 31 May 2006 14:50:40 +0000

Too much imitation. Too much blurring of the line between a document and a program.