Skip to main content

What's the problem with Microsoft Word?

Microsoft logo
2008 HowStuffWorks
In 2006 and 2007, major security flaws were discovered in Microsoft Word.

In the last two months of 2006 alone, at least four major security flaws involving Microsoft Word were revealed. All are "zero day" flaws, meaning Microsoft and security organizations became aware of them at the same time that destructive hackers became aware of them. In many "zero day" cases, it's the exploitation of the flaw that brings it to the attention of the software companies; in other cases, the software companies announce the flaw and hackers immediately take advantage of it before a patch can be released. The strange thing about these Word problems is that almost eight weeks after the flaws were exploited by attackers, Microsoft still hadn't released a patch to fix it.

The first in this string of security holes popped up in early December 2006. This flaw affects computers running Word 2000, 2002 and 2003; Word 2004 for Mac and Word 2004 version X for Mac; Word Viewer 2003; and Microsoft Works 2004, 2005 and 2006. An attacker hides a piece of code in a Word document and puts it on a Web site for download or sends it out as an e-mail attachment. When a user downloads or opens the document, the attacker can remotely control the user's computer and execute a wide array of codes under the user's own login. This flaw came to Microsoft's attention on December 5, 2006, when people started reporting attacks.

A second, previously unknown flaw started to draw attention just a week later, this one also allowing a remote attacker to take control of a user's PC. According to Microsoft, though, this flaw exploits a entirely different security hole -- one that opens when Word undergoes a specific error. Apparently, this attack doesn't require a user to download a malicious file; it only requires the Word program on the person's computer to experience this error, at which point an attacker can enter the system and run malicious code. It affects Word 2000, 2002 and 2003 and Word Viewer 2003.

computer monitor
2008 HowStuffWorks
Software flaws can cause a lot problems through malicious hacking.

Security experts have attributed these two security holes to memory-corruption flaws
in the Word programs. Days later, a third flaw was revealed. This one also allows for remote access and control of a user's machine and has been tied to a buffer-overflow problem in Word. It came to public attention when a software expert called "Disco Johnny" published a proof-of-concept code on the Web that showed how a malicious hacker could exploit it, essentially providing instructions for running an attack in addition to showing Microsoft it has yet another problem.

And about five weeks later, on January 25, a fourth security hole became the subject of a malicious attack that begins when a user opens a rigged Word file sent as an e-mail attachment and has similar results to the previous attacks: Remote access and control of an entire system if it's running Word 2000. If the computer is running Word 2003 or Word XP, it only crashes the computer, as opposed to opening it up to remote control.

These four issues were only the latest in a series of attacks exploiting previously undiscovered flaws in a wide array of Microsoft Office applications. In September 2006, hackers started exploiting another zero-day Word flaw, this one only affecting Word 2000. A user had to open an infected Word 2000 document using the Word 2000 program in order for the virus, MDropper.Q, to drop a piece of code in the user's PC. This allowed a remote attacker to take control of the infected PC.

Microsoft recommends installing multiple layers of security software and updating the versions vigilantly. Beyond that, we can only use the wariness we've become accustomed to when opening attachments or downloading files, with an extension into a traditionally safer area: Now, if it ends with .doc, don't touch it unless you know and trust the source.

Popular posts from this blog

IT EMPLOYEE HEALTH ISSUES

An increasing number of IT professionals have been finding it difficult to handle emotional stress, according to experts. An ‘occupational hazard,' the stress related to work needs to be addressed without delay, they emphasise.

“Coping with stress and striving for mental health welfare should be a matter of concern for all and not treated simply as a lifestyle problem of the ‘IT phenomenon',” says Nithya Chandrasekaran, a consultant physician for many IT companies in the city. Post-recession, employees feel pressured to perform well.

Regular occupational problems such as wrist problems due to constant handling of the mouse, slip disc and eye fatigue are common now, but handling stress that arises owing to fear of losing job or to cope with the increasing competition, affects the employee's performance, eventually, taking a major toll on his health, doctors explain.

The project that K. Balajee (29) was handling was pulled off after six months of its inception. Currently ma…

Internet Safety Tips and Rules

Why is it important to stay safe online?

Most of us are ‘connected’ via our laptops, mobile phones, tablets or personal computer. The potential for the internet to be a valuable and a fun resource for entertainment, making friends, keeping in touch and learning is huge. But if you use the internet, you could be at risk of illegal activity or abuse - be it bullying, fraud or something more serious. Unlike seeing someone face to face, on the net, people aren't always what they first seem.

In the same way you learn about safety when you leave the house, it is important to learn how to stay safe online. These are skills that will stay with you for life.



Internet Safety Tips for Kids and Teens
1. Spend time having fun with your parents online and helping them understand technology!
2. Never post your personal information, such as a cell phone number, home number, home address, or your location on any social networking site or through mobile apps like Snapchat or Instagram.
3. Never me…

Cyber Crime

Cyber Crime is a fast-growing area of crime.More and more criminals are exploiting the speed, convenience and anonymity of the Internet to commit a diverse range of criminal activities that know no borders, either physical or virtual, cause serious harm and pose very real threats to victims worldwide.

What is the Cyber Crime? Cyber crime encompasses any criminal act dealing with computers and networks (called hacking).  Additionally, cyber crime also includes traditional crimes conducted through the Internet.  For example; hate crimes, telemarketing and Internet fraud, identity theft, and credit card account thefts are considered to be cyber crimes when the illegal activities are committed through the use of a computer and the Internet.

Identity theft
Identity theft and fraud is one of the most common types of cyber crime. The term Identity Theft is used, when a person purports to be some other person, with a view to creating a fraud for financial gains. When this is done online on the…