Security Risk In Microsoft Word Documents!?
Posted by: [NT] on: 03/01/2002 11:17 AM [ Print | 2 comment(s) ] · 2447 views
Yesterday I watched The ComputerClub a german TV show and they reported about something very very interesting:
They had a normal MS Word document with just one sentence in it like 'Hello World'. They opened the document with the Norton Commander (you can use a hex-editor or the notepad too). And guess what happened? Read More...
At first impression nothing serious. But then, they scrolled down to the bottom of the page and there were: telephone numbers names parts of personal notes paths to other files and all kinds of other - maybe private and/or secure - information stored within the MS Word document! And this information has never ever been in the document before (like typed in before and then deleted)! The private information stored within MS Word was created and edited with other software (partly non-Microsoft) in different folders. I have tested it on my own and I opened up a document which I received a few days before via email. And I found the same. Information which has nothing to do with the document I received. I found names in it, telephone numbers, even complete adresses.
Why MS Word saves this information in a document we and the ComputerClub are not sure of. Maybe it is a bug or this is done intentionally. A good guess would be that the information somehow slips into Word via the clipboard or some RAM cache. Therefore - keeping our findings in mind - we can only advise users not to send or give away MS Word documents. May it be via email or CD. If you need to sent some text use a simple .txt file for security reasons.
They had a normal MS Word document with just one sentence in it like 'Hello World'. They opened the document with the Norton Commander (you can use a hex-editor or the notepad too). And guess what happened? Read More...
At first impression nothing serious. But then, they scrolled down to the bottom of the page and there were: telephone numbers names parts of personal notes paths to other files and all kinds of other - maybe private and/or secure - information stored within the MS Word document! And this information has never ever been in the document before (like typed in before and then deleted)! The private information stored within MS Word was created and edited with other software (partly non-Microsoft) in different folders. I have tested it on my own and I opened up a document which I received a few days before via email. And I found the same. Information which has nothing to do with the document I received. I found names in it, telephone numbers, even complete adresses.
Why MS Word saves this information in a document we and the ComputerClub are not sure of. Maybe it is a bug or this is done intentionally. A good guess would be that the information somehow slips into Word via the clipboard or some RAM cache. Therefore - keeping our findings in mind - we can only advise users not to send or give away MS Word documents. May it be via email or CD. If you need to sent some text use a simple .txt file for security reasons.
« First C&C: Renegade Patch Out! · Security Risk In Microsoft Word Documents!?
· Windows XP Service Pack News! »
Comment
|
Tetrad Unregistered |
#36676 Posted on: 03/01/2002 07:39 PM
Now why anybody would give away DOC formats instead of the standarized RTF format is beyond me. |
Comment
|
lionheart_40 Unregistered Posts: 1 Joined: 2002-02-27 |
#36677 Posted on: 03/01/2002 08:26 PM
if you have sent your word document to someone and upon exiting word, always choose no when you are asked if you want to save changes to that document, otherwise the next person receiving that document will be able to see who it was previously sent to, email address etc. |
