Of­fice Do­cu­ment Se­cu­ri­ty and Pri­va­cy

  • OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, feature-rich container formats dating back to the early 2000s. In this work, we present a systematic analysis of the capabilities of malicious office documents. Instead of focusing on implementation bugs, we abuse legitimate features of the OOXML and ODF specifications. We categorize our attacks into five classes: (1) Denial-of-Service attacks affecting the host on which the document is processed. (2) Invasion of privacy attacks that track the usage of the document. (3) Information disclosure attacks exfiltrating personal data out of the victim's computer. (4) Data manipulation on the victim's system. (5) Code execution on the victim's machine. We evaluated the reference implementations – Microsoft Office and LibreOffice – and found both of them to be vulnerable to each tested class of attacks. Finally, we propose mitigation strategies to counter these attacks.

Export metadata

Additional Services

Metadaten
Author:Jens Müller, Fabian Ising, Vla­dis­lav Mla­de­nov, Chris­ti­an Mainka, Sebastian Schinzel, Jörg Schwenk
URL:https://www.usenix.org/conference/woot20/presentation/muller
Parent Title (English):14th USE­NIX Work­shop on Of­fen­si­ve Tech­no­lo­gies (WOOT 2020)
Publisher:USENIX
Document Type:Conference Proceeding
Language:English
Date of Publication (online):2020/08/21
Year of first Publication:2020
Provider of the Publication Server:FH Münster - University of Applied Sciences
Release Date:2020/08/21
Tag:Cyber Security; Open Document Format; docx
Faculties:Elektrotechnik und Informatik (ETI)
Publication list:Schinzel, Sebastian
Licence (German):License LogoBibliographische Daten