Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Zero-Day Excel Exploit In the Wild

kdawson posted more than 5 years ago | from the be-careful-out-there dept.

Security 117

snydeq writes "Microsoft Excel has a zero-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec. The problem affects Excel 2007 both without and with Service Pack 1, according to an advisory on SecurityFocus, and other versions going back to Excel 2000. The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file, allowing a hacker to leave a Trojan horse on the infected system."

cancel ×

117 comments

An Exploit (2, Funny)

Anonymous Coward | more than 5 years ago | (#26974393)

An exploit? In my Microsoft product?

SAY IT AIN'T SO!!!

Re:An Exploit (0)

Anonymous Coward | more than 5 years ago | (#26975167)

It's more likely than you think.

Re:An Exploit (1)

ozmanjusri (601766) | more than 5 years ago | (#26979789)

A -1 Troll moderation for mocking Microsoft's deservedly poor reputation for security exploits?

Oh poor Slashdot, how far have ye fallen?

Re:An Exploit (1)

Sinbios (852437) | more than 5 years ago | (#26980071)

I think it's actually mocking the superfluity of this article.

Random E-mails (5, Funny)

0prime (792333) | more than 5 years ago | (#26974451)

Well, let me just open this excel file detailing the financial agreement I will be making with Mr. Ugubu. Surely there is nothing wrong with opening attachments from untrusted sources.

Re:Random E-mails (4, Funny)

the_humeister (922869) | more than 5 years ago | (#26974597)

What do you mean "untrusted." He just sent me an email detailing how he is the caretaker of the Nigerian's former king's fortune. It sounds official too.

Re:Random E-mails (3, Funny)

gEvil (beta) (945888) | more than 5 years ago | (#26974743)

What do you mean "untrusted." He just sent me an email detailing how he is the caretaker of the Nigerian's former king's fortune. It sounds official too.

No kidding. I got an email a few weeks ago from Kofi Annan that talked about how he and some "big wigs at the UN" (his words, not mine) were looking for ways to split up some money, and he was wondering if I would be interested in receiving a share. I've heard of Kofi Annan and know that he was associated with the UN at one point, so it doesn't get any more official sounding than that.

Re:Random E-mails (1)

Forbman (794277) | more than 5 years ago | (#26974937)

...and I got one from a Barrister in Great Britain...

At least they're grammar and structure is get better. [sic]

Re:Random E-mails (1)

mapsjanhere (1130359) | more than 5 years ago | (#26977103)

I got one from a Lt. Col, USArmy, who snatched $25 Million from Saddam. Now that's a trustworthy source, so I couldn't understand why he needed my help as most of it was in $100 bills. Maybe he needed me to carry the suitcases?

Re:Random E-mails (1)

D-Cypell (446534) | more than 5 years ago | (#26980035)

Wow! Sounds like some professional scammer just looked up the word 'plausible' up in the dictionary!

Re:Random E-mails (1)

BrokenHalo (565198) | more than 5 years ago | (#26979383)

I got one from Colonel Gadaffi the other day, but I disregarded it because he spelt his own name wrong. ;-)

Re:Random E-mails (1)

j4s0n (1121943) | more than 5 years ago | (#26975781)

Weird. Every time I try to listen to my E-mails, I just hear music from Star Trek: TMP.

Re:Random E-mails (0)

Anonymous Coward | more than 5 years ago | (#26976103)

I feel sorry for the Nigerian king who does someday actual need help...

Re:Random E-mails (0)

Anonymous Coward | more than 5 years ago | (#26974991)

Pfffft - a few losuy million - that Nigerian 419 scam is soooo last century.

Today's movers and shakedowners go with the Wall Street Bail-out Scam. You can make billions with that one.

Re:Random E-mails (0)

Anonymous Coward | more than 5 years ago | (#26975099)

FIY: it's shakers down, like attorneys general.

Re:Random E-mails (0)

Anonymous Coward | more than 5 years ago | (#26975989)

You are correct member of genus: Nazis, species: Grammar.

Oh, and FYI: it's FYI, not FIY :)

Re:Random E-mails (1, Funny)

Anonymous Coward | more than 5 years ago | (#26978985)

In Soviet Russia For Infos You!!!

Re:Random E-mails (5, Insightful)

Lord Ender (156273) | more than 5 years ago | (#26975029)

Surely there is nothing wrong with opening attachments from untrusted sources.

The real danger is in opening attachments from trusted sources. If this is used with an email worm, it will look like it is coming from your friends, coworkers, or any of your eight bosses. As a high priority, due yesterday, mission-critical action-item.

Re:Trusted (1)

TaoPhoenix (980487) | more than 5 years ago | (#26975581)

"It's worse than that Jim".

If used with the email worm on your less savvy coworker, it will infect HIM (her, or it) ... and really BE coming from your coworker.

Re:Random E-mails (1)

_avs_007 (459738) | more than 5 years ago | (#26977411)

That's why(among other things) we have to use cryptography on anything we send via email, so it's authenticity and integrity can be verified.

But IT really hates when people send large documents back and forth over email, so we also have secure online repositories that people are supposed to push/pull documents to/from for x-group collaboration.

Re:Random E-mails (-1, Redundant)

Beardo the Bearded (321478) | more than 5 years ago | (#26975367)

I was just thinking that - it's 2009. Who is still opening DOC or XLS attachments?

My grandfather doesn't open those kinds of files. Okay, admittedly, he's dead, but the point is still valid.

Re:Random E-mails (5, Insightful)

aarroneous (973056) | more than 5 years ago | (#26975865)

I was just thinking that - it's 2009. Who is still opening DOC or XLS attachments?

Umm... practically any company that does business with any municipal or state governmental agencies, law firms, accounting firms, etc etc. The question is who isn't opening DOC or XLS attachments from their clients, and how do they plan to stay in business?

Re:Random E-mails (1)

bootup (1220024) | more than 5 years ago | (#26978957)

When I started my business I knew that there would be challenges sticking with free software / open source principles and solutions. Having been in business for several months now I realize just how challenging it is not to do things like open word documents. For instance HP won't authorize me to be a reseller if I don't fill out document X. Document X may not be in MS Word format, however it requires me to have Y. Geting Y is only possible by gong through company D. Company D only supports MS Internet Explorer to get an account that would let me get Y.

I can't exactly avoid HP. HP is the only company that actually supports GNU/Linux well in the printer world at the low end of the market.

OK- Next thing I need are high quality custom labels for a particular product I've developing. I look into doing it myself. Turns out I can't make them myself since printers with white ink are too expensive. The product I'm developing is based on a third party case that can't be changed-since nobody else produces cases that will work for my particular product. The black case means the labels I need for my product must be black with white lettering. The only way to get black labels with white lettering of the size I need them is through one or two particular companies. So- I contact these companies. I spend months talking to them about what they can do for me. Each day I get a new email and respond. Each day I get a little further. Finally after a month or two I find out that they have to order custom dies for my labels since they are non-standard. Instead of taking several weeks to produce they now will be several weeks plus the time it takes to get the dies made. That adds months to the time. However, they will have to get back to me on the dies so in addition to the months it will take weeks or months just to find out how to get them made by the third company. Several more weeks go bye. No emails. I email them. They say they are working on it. Finally I give up and find a less desirable solution. The thing is the whole time I was interacting with them they were sending me MS Word documents. I couldn't afford not to open them if I wanted to get this project done. It just wasn't going to happen. Each question I had to ask took them a day to respond as it was. How on earth would I have gotten it done if I had to do this with every business I contacted? This is not to say I shouldn't be trying to correct bad habits of users and other businesses. I do that every day. It just isn't always realistic that I'll be able to correct every body.

Re:Random E-mails (1)

meringuoid (568297) | more than 5 years ago | (#26981427)

There's always AbiWord or OpenOffice.org. Determining to use only free software is admirable; refusing to use de-facto standard non-free document formats when they are very well understood by mature free applications, well, that's just masochism. Publish your own materials in free formats by all means, but if free software is capable of deciphering non-free formats sent to you by others then one shouldn't make too much of a fuss over the principle. Strict in what you send, tolerant in what you receive, that's the ticket.

Re:Random E-mails (1)

amias (105819) | more than 5 years ago | (#26980747)

er , google and lots and lots and lots of others

something is wrong with the moderation round here where someone can get a score 5 insightful for denying the existance of google docs.

Re:Random E-mails (1)

aarroneous (973056) | more than 5 years ago | (#26981143)

If you truly believe that google, red hat, or "many other's" sales, marketing, and accounting departments don't find themselves using or opening word and excel attachments, you're either woefully misinformed, or simply delusional.

Funny, but that won't help solve the problem. (3, Interesting)

jbn-o (555068) | more than 5 years ago | (#26977589)

Some people have jobs which require opening email attachments from unknown people. Secretaries are often the first point of contact for files sent by the general public. The secretary is often charged with opening the attached file(s) to make sure they're conformant in some organizational sense, then placing a copy of the file somewhere appropriate (such as a file server where other people can further vet the files).

I can easily see a situation where people are asked to upload files via a website to be opened by a committee later. Then everyone on the committee could be running on their machine with an administrative account (common for people who just bought a computer, sometimes having an admin account is viewed as a position of power and privilege).

I'm not saying that any of these problems can't be solved. I'm saying that to frame the issue as strange malcontents trying to take advantage of someone isn't addressing the complexity of the issue at hand.

It seems that this is just another area where overly-capable file formats, proprietary software, and programs that attempt to do too much are all coming together in an unpleasant way...again.

Re:Random E-mails (1)

hesaigo999ca (786966) | more than 5 years ago | (#26981061)

Well people you trust can be infected too and not know it and send you a picture of themselves on holiday, and you just viewed a .jpg that contained a hidden virus....it has happened. The whole email attachment bit is what I don't get, why send me attachments at all....unless I ask for them , then I get them....if you tell me the joke I wont need to download a 3mb powerpoint of it!!!

With all due respect... (1)

Benfea (1365845) | more than 5 years ago | (#26981369)

isn't there malware out there that can make it look like you are receiving an email from someone you know?

If so, this is not just a matter of being smart enough to not open attachments from strangers.

and you thought that math "error" was a mistake... (1)

Shakrai (717556) | more than 5 years ago | (#26974463)

.... it was really protection to save you from trojans. Everybody knows that all trojans and exploits begin with the following code:

if (65535==65535) { install trojan; } else { don't install trojan; }

Re:and you thought that math "error" was a mistake (3, Informative)

Smidge207 (1278042) | more than 5 years ago | (#26974513)

Nope; that just plays Flight Simulator. ;-)

=Smidge=

Re:and you thought that math "error" was a mistake (1)

Peaceful_Patriot (658116) | more than 5 years ago | (#26976015)

Ha! Without a doubt, the very best easter egg ever. I know they are considered bloat nowadays, but I always enjoyed them.

zero day? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#26974503)

Does it really count as zero-day if it's been a bug for 9 years?

Re:zero day? (4, Funny)

orzetto (545509) | more than 5 years ago | (#26974795)

I think it is the count of how much time Microsoft has been working on the bug.

Re:zero day? (0)

Anonymous Coward | more than 5 years ago | (#26976329)

What about using openoffice as an immediate workaround ;)

Re:zero day? (5, Informative)

PitaBred (632671) | more than 5 years ago | (#26974905)

Zero-Day [wikipedia.org] does not mean the day the bug was released. It means that it is a bug that is being exploited in the wild before a patch can be released. It doesn't matter when the bug was first coded. Compare that to a theoretical bug discovered by researchers that COULD be exploited, but isn't yet.

I normally wouldn't respond to an AC seemingly obvious misconception, but the fact that he was modded up means that people with mod points apparently don't have a clue, either...

Re:zero day? (1)

n1ckml007 (683046) | more than 5 years ago | (#26975055)

mod parent up, this is the correct definition.

Re:zero day? (5, Informative)

Lord Ender (156273) | more than 5 years ago | (#26975089)

the fact that he was modded up means that people with mod points apparently don't have a clue, either...

Welcome to slashdot!

Re:zero day? (2, Funny)

wastedlife (1319259) | more than 5 years ago | (#26975459)

The fact that this was modded informative is one of the funniest things I've seen all day.

Re:zero day? (1)

CannonballHead (842625) | more than 5 years ago | (#26975707)

maybe that was an effort to make it funny. :)

Re:zero day? (1)

wish bot (265150) | more than 5 years ago | (#26977833)

Back in the day it was common to give really funny comments an underrated/informative/interesting mod because the 'funny' mod didn't give you karma. There are still one or two guys from that era around...

Re:zero day? (1)

treeves (963993) | more than 5 years ago | (#26978095)

Or 5...

Re:zero day? (1)

harry666t (1062422) | more than 5 years ago | (#26975243)

You're right, it's 3287-day.

Zero Day??? (0)

Anonymous Coward | more than 5 years ago | (#26974505)

How is it a zero day two years after it was launched...

Re:Zero Day??? (1)

jasmak (1007287) | more than 5 years ago | (#26974833)

Zero day attack, exploitation of unpatched software vulnerabilities

A work-around for it... apk (2, Interesting)

Anonymous Coward | more than 5 years ago | (#26974507)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001

APK

Re:A work-around for it... apk (3, Insightful)

fuzzyfuzzyfungus (1223518) | more than 5 years ago | (#26974607)

That is only a workaround if you hate the guts of everybody who works the help desk...

According to MS? It IS a work-around for this (5, Informative)

Anonymous Coward | more than 5 years ago | (#26975021)

"That is only a workaround if you hate the guts of everybody who works the help desk." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @03:33PM (#26974607)

I suggest you do a bit of reading here then from the URL below...

(Simply because, based on the data about this (straight from the horses' mouth @ MS)? There is a GOOD chance your networking folks will merge this on bootup logon scripts to protect you with it, @ this point so far @ least!)

Microsoft Security Advisory (968272)

Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution

http://www.microsoft.com/technet/security/advisory/968272.mspx [microsoft.com]

----

SALIENT EXCERPT/QUOTE:

"Suggested Actions

Microsoft has tested the following workarounds. Although these workarounds will not correct the underlying vulnerability, they help block known attack vectors. When a workaround reduces functionality, it is identified in the following section:

For Office 2003

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]

"BinaryFiles"=dword:00000001

Note In order to use 'FileOpenBlock' with Office 2003, all of the latest Office 2003 security updates must be applied.

Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.

For 2007 Office system

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]

"BinaryFiles"=dword:00000001

Note In order to use 'FileOpenBlock' with the 2007 Microsoft Office system, all of the latest security updates for the 2007 Microsoft Office system must be applied.

Impact of Workaround: Users who have configured the File Block policy and have not configured a special exempt directory as discussed in Microsoft Knowledge Base Article 922848 will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System.

How to Undo the Workaround:

For Office 2003

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Excel\Security\FileOpenBlock]

"BinaryFiles"=dword:00000000

For 2007 Office system

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Excel\Security\FileOpenBlock]

"BinaryFiles"=dword:00000000"

----

Especially since currently there is apparently NO other way to @ least protect yourself from this attack...

APK

P.S.=> The "adverse impacts" of this temporary work-around fix, IF any, are listed on said page also... apk

Re:According to MS? It IS a work-around for this (3, Insightful)

fuzzyfuzzyfungus (1223518) | more than 5 years ago | (#26975215)

"will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System"

That isn't going to go over well. At all.

Re:According to MS? It IS a work-around for this (0)

Anonymous Coward | more than 5 years ago | (#26975489)

"That isn't going to go over well. At all." - by fuzzyfuzzyfungus (1223518) on Tuesday February 24, @04:21PM (#26975215)

I'd be inclined to agree, & don't like it any more than you do, because of the "catch-22" involved here - &, you're right (based on what's on the URL page from MS I posted, as to any "side-effects" of this patch)!

I say that, simply because, @ least in the workplace, where folks use Excel spreadsheets for daily accounting purposes (& other uses too)? It's NOT going to "go over well" @ all- Especially since I am certain those people will probably NEED to access said spreadsheets to some degree (in the timeframe it takes MS to make up a binary patch for Excel)

E.G.-> I tested it myself, & it doesn't allow Excel to work on spreadsheets created in ANY version of Excel .xls sheets I have opened here, thusfar.

LOL, sure - "THAT would keep you safe"(r) vs. this exploit (&, it does, so the sarcasm on my part here isn't exactly unjustified), but it is like busting your nose w/ a sledgehammer, to get rid of a fly landing on it!

----

However:

Apparently, it will have do the job, according to MS, for now...

(OR, @ least until MS releases a patch next "Patch Tuesday" next month (2nd Tuesday of EVERY month)... After all - the alternative of being infested by this malware machination might be a lot worse).

This doesn't affect MYSELF so much, as I am NOT a "big Excel user", as it would others in say, a corporate Office environs where MS Office usage is usually rampant & where folks have to use it.

APK

P.S.=> I am surprised MS hasn't issued an "out-of-band" patch for it yet, because in these types of cases, they usually do & fast... so, based on that, I'd guess that SOMEONE @ MS is hard at work building such an "out of band" patch, hopefully, & we get it issued to us all, before the 3 weeks passes to the next Microsoft "Patch Tuesday" next month (approximately 3 weeks away from today's date roughly)... apk

Re:According to MS? It IS a work-around for this (2, Informative)

Planesdragon (210349) | more than 5 years ago | (#26977013)

I say that, simply because, @ least in the workplace, where folks use Excel spreadsheets for daily accounting purposes (& other uses too)? It's NOT going to "go over well" @ all- Especially since I am certain those people will probably NEED to access said spreadsheets to some degree (in the timeframe it takes MS to make up a binary patch for Excel)

*ahem*

1: Excel 2007 has seperate file types for "yes macro XML", "no macro XML", and "old crappy binary" formats. .xlsx, .xlsm, and .xls, respectively. The first, .xlsx, is immune to trojan hacks the same way a .txt file in notepad is immune to them.

2: Excel 2003 has a COMPLETELY FREE UPDATE that lets it write and read .xlsx files.

3: Anyone who isn't using 2007 or 2003 can use OpenOffice, which, again, is highly resistant (immune?) to this bug. And can save to .xlsx.

Anyone using Excel probably needs it--but the few of us who use Excel and need macros, well, we should be smart enough to avoid viruses. Users who aren't can stick to .xlsx, and they'll be all set.

Re:According to MS? It IS a work-around for this (1)

fuzzyfuzzyfungus (1223518) | more than 5 years ago | (#26977417)

And what, pray tell, will the people who need to open .xls files sent to them by others, or previously created, do?

Re:According to MS? It IS a work-around for this (1)

EveLibertine (847955) | more than 5 years ago | (#26978179)

And what, pray tell, will the people who need to open .xls files sent to them by others, or previously created, do?

Open Office?

Re:According to MS? It IS a work-around for this (1)

ion.simon.c (1183967) | more than 5 years ago | (#26979281)

Did you switch around the extensions for "yes" and "no macro XML" file formats, or is the "no macro" extension really ".xlsm"? If it is, that's kinda confusing.

what's the big deal? (1)

commodoresloat (172735) | more than 5 years ago | (#26977231)

We already can't open Office 2007 documents in Office 2003 so this just equalizes things.

Re:what's the big deal? (1)

EveLibertine (847955) | more than 5 years ago | (#26978205)

Maybe I'm missing the humor here, but there is a compatibility pack for opening Office 2007 files in Office 2003.

FileFormatConverters [microsoft.com]

Re:According to MS? It IS a work-around for this (1)

StuartHankins (1020819) | more than 5 years ago | (#26976911)

Special File Exempt directory... hmmm what about the people who have Excel files in potentially hundreds of folders spread across many network servers? Ugh.

But thanks for the workaround anyway, really it's better than nothing for those companies that must run Excel.

OpenOffice keeps looking better and better every time this stuff happens. I haven't launched Office except to accept meeting invitations (and once to convert some Ami pro files) in years.

Re:A work-around for it... apk (1)

Sir_Lewk (967686) | more than 5 years ago | (#26974955)

Cripes! And people say unix is complicated!

Re:A work-around for it... apk (1)

spacefiddle (620205) | more than 5 years ago | (#26976421)

Official Microsoft Workaround: Get up from your desk, step around it, and stop working.

Re:A work-around for it... apk (1)

ion.simon.c (1183967) | more than 5 years ago | (#26979291)

Thanks for not sourcing your information.

Re:A work-around for it... apk (2)

meringuoid (568297) | more than 5 years ago | (#26981379)

The average end-user doesn't want to have to open registry editors and manually modify esoteric values in obscure text configuration files. No matter how much hobbyists and enthusiasts wish otherwise, until there's an idiot-proof GUI that makes all of this happen in a single click, Windows will never be ready for the mainstream desktop.

Simple Answer for Microsoft... (0, Troll)

BoRegardless (721219) | more than 5 years ago | (#26974561)

License Apple's OSX and layoff 30,000 people and just color the startup screen Vista Blue with the appropriate logo.

Then Microsoft will have to get busy making actual applications that WORK, consistently, easily & productively, on the NIXs & OSX.

I am a dreamer.

Re:Simple Answer for Microsoft... (2, Informative)

the_humeister (922869) | more than 5 years ago | (#26974635)

Yes, and then break all compatibility with all current applications that are currently running on Windows.

Besides, Darwin is open source. MS could just use Darwin as the base and write a Windows compatible GUI on top of that.

Re:Simple Answer for Microsoft... (2, Insightful)

commodoresloat (172735) | more than 5 years ago | (#26974733)

Yes, and then break all compatibility with all current applications that are currently running on Windows.

That's an added advantage of such an approach. Bonus!

Re:Simple Answer for Microsoft... (1)

icannotthinkofaname (1480543) | more than 5 years ago | (#26976241)

Agreed. It would be nice to see the day when Windows would no longer be able to run the viruses of yesteryear/yesterversion/[time period of your choosing].

Truly, breaking compatibility with current Windows stuff would be a plus.

Re:Simple Answer for Microsoft... (1)

harry666t (1062422) | more than 5 years ago | (#26975319)

Darwin is probably less portable and supports less hardware than, say, the BSDs or Linux. If I were MS I'd use FreeBSD (to avoid the GPL), and maybe take the old (BSD-licensed) version of Wine and patch it with bits of the original implementation of win32 to have some backward compatibility.

From what I've heard MS even has an open source (but non-free) implementation of .NET (AFAIR called Rotor) that works under FreeBSD. Hm...

Re:Simple Answer for Microsoft... (1)

RCL (891376) | more than 5 years ago | (#26975711)

From what I've heard MS even has an open source (but non-free) implementation of .NET (AFAIR called Rotor) that works under FreeBSD. Hm...

That's here [microsoft.com] - it's unusual to see FreeBSD in requirements on Microsoft Downloads site :)

If I were MS I'd use FreeBSD (to avoid the GPL), and maybe take the old (BSD-licensed) version of Wine and patch it with bits of the original implementation of win32 to have some backward compatibility.

You don't know what you are talking about. Going to break binary compatibility for millions of applications (most of which are without sources)? That's a suicide for every company.

If you ever tried to change whatever API/ABI that has a lot of (external) client code - no matter, commercial or not, you'd understand how much woe it inflicts on your client developers. Even in opensource world, deprecated things (like libbonobo) hang around for long.

The main reason why Windows is so popular is because of its continuous binary compatibility spanning 10+ years.

Re:Simple Answer for Microsoft... (1)

BoRegardless (721219) | more than 5 years ago | (#26976411)

If MS can't make, a dramatically better OS, the question ultimately becomes when to they get out of the OS business.

Is a proprietary OS going to be the revenue generator for the future? Maybe, maybe not.

It sure looks like the future is spelled "small", as in eeePC, netbook, tabook, smartphone, MacBook Air & Similar devices, where the smooth running total system is what users want, and they don't want to fiddle with or debug the OS. That drives the average user nuts. Dell is starting to sell Linux installed and many other companies are doing so.

I'll use whatever I have to use to get my work done (including OSX & XP Pro right now), but given a choice I want a minimum hassle machine. I don't know if Win7 is going to be it, but comments and experience tells me probably not.

With a troublesome Win7 (Sheepskin over Vista), is MS going to just push customers to other OSs?

Re:Simple Answer for Microsoft... (1, Informative)

Anonymous Coward | more than 5 years ago | (#26974667)

I don't really know how stable it's really considered, but I've had more application crashes on the latest kubuntu updated with kde 4.2 in a week of idle tinkering (apps from the default install, network manager, all kinds of things) than I have on vista 64 in several months of constant work.

not a trojan, an expansion for the secret games (1)

leetrout (855221) | more than 5 years ago | (#26974567)

1. Open up a new document.
2. Press F5.
3. Type in x97:L97 in the reference box and press enter.
4. Press tab.
5. Hold down ctrl+shift.
6. While holding these two buttons click on the chart wizard button on the icon bar (the button looks like a bar graph).
7. Play the game while it secretly crafts a worm to take the extra money when transactions are rounded (only a few hundredths of a cent) and deposits them in an offshore account.
8. ...?
9. PROFIT!

Re:not a trojan, an expansion for the secret games (1)

Shakrai (717556) | more than 5 years ago | (#26974657)

Play the game while it secretly crafts a worm to take the extra money when transactions are rounded (only a few hundredths of a cent) and deposits them in an offshore account.

Be careful. Such games have been known to take a few hundredths of a billion and upgrade the crime from white collar resort prison to pound-me-in-the-ass prison ;)

Any chance DEP stops this? (1)

anss123 (985305) | more than 5 years ago | (#26974571)

So that I can feel good about having it turned on for all apps.

Re:Any chance DEP stops this? - YES, SLIM. (0)

Anonymous Coward | more than 5 years ago | (#26974893)

DEP has a very slim chance of stopping this malicious excel file from installing the trojan - If it crashes your OS before you load Excel.

Re:Any chance DEP stops this? - YES, SLIM. (1)

anss123 (985305) | more than 5 years ago | (#26975043)

If it crashes your OS before you load Excel.

Well, there's still UAC if DEP fails to crash the OS :)

did you not see (0)

Anonymous Coward | more than 5 years ago | (#26974591)

Superman 3?

Re:did you not see (1)

n0dna (939092) | more than 5 years ago | (#26974711)

The exploit is made of Tar?

Re:did you not see (0)

Anonymous Coward | more than 5 years ago | (#26980133)

Well he isn't gonna smoke it :)

(posting anon because I modded)

-- Killjoy_NL

And what about SharePoint? (4, Interesting)

Penguinisto (415985) | more than 5 years ago | (#26974643)

While such a vector would be pretty useless on the public nets, just out of academic curiosity, I wonder: how fast would this critter would travel if it got loaded onto a SharePoint site (you know, one with the handy Excel-handling plugin turned on?)

Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?

/P

Re:And what about SharePoint? (1)

Planesdragon (210349) | more than 5 years ago | (#26977033)

Looking at it from the other end, how do you protect from such an eventuality without shutting off the plugin?

Same way you protect the client -- disable .xls binary files.

OTOH, Sharepoint's Excel Web Services is a bitch to get anything to run, even when you're trying to. If you're using SharePoint in lieu of client-side Excel, it should effectively immuninize you from this bug, same as if you used OpenOffice on the client.

Another reason I can't use OpenOffice ..... (5, Funny)

whoever57 (658626) | more than 5 years ago | (#26974839)

With yet another incompatibility between OpenOffice and Excel, I really can't use OpenOffice.

I use Lotus 123 and WordPerfect (0)

Anonymous Coward | more than 5 years ago | (#26974923)

You can't attack me... I use MSDOS v6.11, lynx and the Crynwr network stack

Use windows - get shafted (-1, Troll)

1s44c (552956) | more than 5 years ago | (#26974949)

Use windows and get shafted.

It's business as usual.

Dangit!! (0)

Anonymous Coward | more than 5 years ago | (#26975007)

How am I supposed to open my maliciously crafted Excel spreadsheets now???

Next up: Zero-day Notepad exploit found (5, Funny)

kkrajewski (1459331) | more than 5 years ago | (#26975153)

Reading plaintext unsafe. News at eleven.

Re:Next up: Zero-day Notepad exploit found (1)

overlordofmu (1422163) | more than 5 years ago | (#26975971)

Someone with mod points, please give this some funny street cred! Funny!

Re:Next up: Zero-day Notepad exploit found (1)

nan0meter (1387177) | more than 5 years ago | (#26977379)

Rofl, even when you print it? oh dear where's the world going!

Re:Next up: Zero-day Notepad exploit found (0)

Anonymous Coward | more than 5 years ago | (#26977449)

And yet, on Vista, apparently it will pop up a UAC warning when you try to view the source of a webpage in Notepad.

MS Vista becoming more secure? (2, Interesting)

wealthychef (584778) | more than 5 years ago | (#26975673)

FTFA: "Hackers have increasingly sought to find vulnerabilities in applications as Microsoft has spent much effort into making its Vista OS more secure."

Is this true? Any corroborating info from anyone?

Re:MS Vista becoming more secure? (-1, Troll)

Anonymous Coward | more than 5 years ago | (#26975797)

Yes

Look, Vista is not affected by this bug... read that report!

Personally, we have just under 200 machines here and I do not have anti virus on a single one (our gateway does virus scanning on everything first)... I use group policy and set UAC toblock pretty much everything and we have not had a single problem since we deployed vista when it first came out.

People can laugh, People can say what they like, but I am a very happy system admin, and Vista has made my job so much easier.

Re:MS Vista becoming more secure? (2, Insightful)

StikyPad (445176) | more than 5 years ago | (#26977015)

Saying you've never had a virus without ever scanning your PCs is like saying you've never had an STD without ever getting tested. In both cases, you can have infections without symptoms, and the infections can be transmitted. Yes, there are false negatives, but that's no excuse to abstain from testing.

Granted, you said "never had a problem," not "never had a virus," but what you really meant was that you've never seen a problem. Considering that most malware these days is designed to run unnoticed rather than to cause harm to the desktop, that's not really surprising. There ARE worms that affect Vista, and for all you know, your servers have rootkits on them. Or not. One thing's for sure: it's irresponsible, borderline incompetent to admin a Windows network without any AV, especially a corporate network (i.e., those that probably store private AND valuable information, as opposed to simply private information that's probably on your desktops at home).

Re:MS Vista becoming more secure? (1)

nulldaemon (926551) | more than 5 years ago | (#26977537)

Saying you've never had a virus without ever scanning your PCs is like saying you've never had an STD without ever getting tested.

I'm sure most slashdot users can say this and be 100% correct.

Re:MS Vista becoming more secure? (1)

AliasMarlowe (1042386) | more than 5 years ago | (#26979903)

Saying you've never had a virus without ever scanning your PCs is like saying you've never had an STD without ever getting tested.

I'm sure most slashdot users can say this and be 100% correct.

Depends how you classify their need for thick eyeglasses...

Re:MS Vista becoming more secure? (1)

awpoopy (1054584) | more than 5 years ago | (#26977893)

Do a little research. Vista admins are so - well, I wouldn't want my karma to go down.
First: You are an idiot for:
A. Running Vista in a business already. Repeat after me: Service Pack 2 Plus 6 months for anything Microsoft makes.
B. No AV on a windows domain? Are you fucking nuts?
Here's what you could have found had you looked. Vista IS affected. This issue is on all versions of windows and all versions of excel.
Discovered: February 23, 2009
Updated: February 24, 2009 2:05:20 PM
Type: Trojan
Infection Length: 57,306 bytes
Systems Affected: Windows Vista, Windows XP, Windows 2000, Windows NT
Trojan.Mdropper.AC is a Trojan horse that may exploit the Microsoft Excel Unspecified Remote Code Execution Vulnerability (BID 33870). It may also attempt to download files on to the compromised computer.

Re:MS Vista becoming more secure? (1)

justinlee37 (993373) | more than 5 years ago | (#26976593)

I never have issues with Vista. Of course, I'm also smart & knowledgeable enough not to open suspicious files or file attachments, run Avast! Antivirus, Spybot S&D, and Spybot's add-on program Teatimer (a handy thing that allows you to approve or deny any registry changes that occur at any time, during either installations or accidental visits to malicious websites that do things like change your registry entries to modify your "home page" to direct you to their site).

I also usually have at least 2 computers on hand, so if a virus makes the thing totally FUBAR, I can recover the files by using the non-FUBAR'ed computer to access the other's hard drive, then format the drive and reinstall windows/drivers/etc. from scratch. You KNOW the virus is gone then. This is also a good way to diagnose a computer and see if a malfunction is related to software or hardware.

Needless to say, I don't have problems with any operating system regarding it's security. And with 8gb's of RAM, Vista works great! So does Crysis, incidentally.

I guess it would run Linux too. Never bothered with it honestly. Though those boot-from-disk copies of Ubuntu are pretty rad. Like a petty hacker's wet dream.

Re:MS Vista becoming more secure? (1)

commodoresloat (172735) | more than 5 years ago | (#26977239)

Just edit the article and add a [citation needed] tag; I'm sure someone will add the evidence.

What? Oh. Nevermind.

Vista (0)

Anonymous Coward | more than 5 years ago | (#26975977)

Anyone see, Vista is not affected by this?

Yes

Look, Vista is not affected by this bug... read that report!

Personally, we have just under 200 machines here and I do not have anti virus on a single one (our gateway does virus scanning on everything first)... I use group policy and set UAC toblock pretty much everything and we have not had a single problem since we deployed vista when it first came out.

People can laugh, People can say what they like, but I am a very happy system admin, and Vista has made my job so much easier.

Re:Vista (1)

Skater (41976) | more than 5 years ago | (#26977663)

Not according to the article: "The program's vulnerability can be exploited if a user opens a maliciously crafted Excel file. Then, a hacker could run unauthorized code. Symantec has detected that the exploit can leave a Trojan horse on the infected system, which it calls "Trojan.Mdropper.AC."

That Trojan, which works on PCs running the Vista and XP operating systems, is capable of downloading other malware to the computer."

The report says: "Systems Affected: Windows Vista, Windows XP"

I like this part in TFA (0)

Anonymous Coward | more than 5 years ago | (#26976095)

where it says this and there is nothing below it:

Not Vulnerable:

Coincidence? (5, Funny)

chill (34294) | more than 5 years ago | (#26976467)

Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".

Fast forward many years. Microsoft closed down Flight Simulator and a few days later there is a "several year old zero-day" exploit in, of all places, Excel.

Coincidence? I THINK NOT! Paybacks are a bitch, aren't they Mr. Ballmer?

Re:Coincidence? (1)

jonaskoelker (922170) | more than 5 years ago | (#26977707)

Once, long ago, Excel had a full flight simulator hidden in the code. Then Microsoft created the Flight Simulator team and it was one of their landmark "games".

Taking a trip in the time machine, this would disprove the assertion that there are no games for the Mac! ;-)

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...