<3?php
/**
 * This file is part of OPUS. The software OPUS has been originally developed
 * at the University of Stuttgart with funding from the German Research Net,
 * the Federal Department of Higher Education and Research and the Ministry
 * of Science, Research and the Arts of the State of Baden-Wuerttemberg.
 *
 * OPUS 4 is a complete rewrite of the original OPUS software and was developed
 * by the Stuttgart University Library, the Library Service Center
 * Baden-Wuerttemberg, the Cooperative Library Network Berlin-Brandenburg,
 * the Saarland University and State Library, the Saxon State Library -
 * Dresden State and University Library, the Bielefeld University Library and
 * the University Library of Hamburg University of Technology with funding from
 * the German Research Foundation and the European Regional Development Fund.
 *
 * LICENCE
 * OPUS is free software; you can redistribute it and/or modify it under the
 * terms of the GNU General Public License as published by the Free Software
 * Foundation; either version 2 of the Licence, or any later version.
 * OPUS is distributed in the hope that it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
 * details. You should have received a copy of the GNU General Public License
 * along with OPUS; if not, write to the Free Software Foundation, Inc., 51
 * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 *
 * @category    Application
 * @author      Julian Heise <heise@zib.de>
 * @author      Thoralf Klein <thoralf.klein@zib.de>
 * @author      Sascha Szott <szott@zib.de>
 * @author      Jens Schwidder <schwidder@zib.de>
 * @copyright   Copyright (c) 2010-2017, OPUS 4 development team
 * @license     http://www.gnu.org/licenses/gpl.html General Public License
 */

$config = Zend_Registry::get('Zend_Config');

$pageLanguage = Zend_Registry::get('Zend_Translate')->getLocale();

$this->headMeta()
    ->prependHttpEquiv('Content-Type', 'text/html; charset=UTF-8')
    ->prependHttpEquiv('Content-Language', $pageLanguage);

$this->headTitle('OPUS 4')
    ->setSeparator(' | ');

if (isset($config->instance_name)) {
    $this->headTitle($config->instance_name);
}

if (isset($this->title)) {
    if ($this->moduleName !== 'frontdoor')
    {
        $this->headTitle($this->translate($this->title));
    }
    else
    { // do not translate for frontdoor, because the document title is used
        $this->headTitle(htmlspecialchars($this->title));
    }
}

$this->headLink()
    ->appendStylesheet('https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css')
    ->appendStylesheet($this->baseUrl() . '/' . $config->css->jqueryui->path, 'screen')
    ->appendStylesheet($this->layoutPath() . '/css/opus.css', 'screen,print')
    ->appendStylesheet($this->layoutPath() . '/css/admin.css', 'screen,print')
    ->appendStylesheet($this->layoutPath() . '/css/print.css', 'print')
    ->appendStylesheet($this->layoutPath() . '/css/custom.css')
    ->headLink(array(
        'rel' => 'shortcut icon',
        'type' => 'image/x-icon',
        'href' => $this->layoutPath() . '/img/logo/favicon.ico'))
    ->headLink(array(
        'rel' => 'search',
        'title' => 'OPUS 4 Search',
        'type' => 'application/opensearchdescription+xml',
        'href' => $this->serverUrl() . $this->baseUrl() . '/solrsearch/opensearch'));

$this->container = Zend_Registry::get('Opus_Navigation');

$jsFiles = array('searchutil.js', 'frontdoorutil.js', 'submit.js');

if (in_array($this->moduleName, array('admin', 'review', 'setup', 'account'))) {
    $jsFiles[] = 'theme.js';
    $jsFiles[] = 'theme_lic.js';
    $jsFiles[] = 'opus-ui.js';
}
else if (in_array($this->moduleName, array('publish'))) {
    $jsFiles[] = 'filetypes.js';
}

if ($this->jQueryEnabled()) {
    foreach (array_reverse($jsFiles) as $filename) {
         $this->headScript()->prependFile($this->layoutPath() . '/js/' . $filename);
    }

    $this->headScript()->prependFile($this->baseUrl() . '/' . $config->javascript->jqueryui->path);
    $this->headScript()->prependFile($this->baseUrl() . '/' . $config->javascript->jquery->path);
}

$appConfig = new Application_Configuration();

if ($appConfig->isLanguageSelectionEnabled()) {
    $languageSelectors = $this->languageSelector();
}
else {
    $languageSelectors = null;
}

if (isset($config->javascript->latex->mathjax)) {
    $this->headScript()->appendFile($this->baseUrl() . $config->javascript->latex->mathjax, 'text/javascript');
}
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="" lang="" dir="ltr" class="no-js">

    <head>
        <meta name="Opus-Version" content="4.6.3" />
        <meta http-equiv="Last-Modified" content="Thu, 25 Mar 2021 08:32:45 +0100" />
        <meta name="DC.Creator" content="Müller, Jens" />
        <meta name="author" content="Müller, Jens" />
        <meta name="citation_author" content="Müller, Jens" />
        <meta name="DC.Creator" content="Ising, Fabian" />
        <meta name="author" content="Ising, Fabian" />
        <meta name="citation_author" content="Ising, Fabian" />
        <meta name="DC.Creator" content="Mla­de­nov, Vla­dis­lav" />
        <meta name="author" content="Mla­de­nov, Vla­dis­lav" />
        <meta name="citation_author" content="Mla­de­nov, Vla­dis­lav" />
        <meta name="DC.Creator" content="Mainka, Chris­ti­an" />
        <meta name="author" content="Mainka, Chris­ti­an" />
        <meta name="citation_author" content="Mainka, Chris­ti­an" />
        <meta name="DC.Creator" content="Schinzel, Sebastian" />
        <meta name="author" content="Schinzel, Sebastian" />
        <meta name="citation_author" content="Schinzel, Sebastian" />
        <meta name="DC.Creator" content="Schwenk, Jörg" />
        <meta name="author" content="Schwenk, Jörg" />
        <meta name="citation_author" content="Schwenk, Jörg" />
        <meta name="DC.title" content="Of­fice Do­cu­ment Se­cu­ri­ty and Pri­va­cy" />
        <meta name="title" content="Of­fice Do­cu­ment Se­cu­ri­ty and Pri­va­cy" />
        <meta name="citation_title" content="Of­fice Do­cu­ment Se­cu­ri­ty and Pri­va­cy" />
        <meta name="DC.Description" content="OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, feature-rich container formats dating back to the early 2000s. In this work, we present a systematic analysis of the capabilities of malicious office documents. Instead of focusing on implementation bugs, we abuse legitimate features of the OOXML and ODF specifications. We categorize our attacks into five classes: (1) Denial-of-Service attacks affecting the host on which the document is processed. (2) Invasion of privacy attacks that track the usage of the document. (3) Information disclosure attacks exfiltrating personal data out of the victim's computer. (4) Data manipulation on the victim's system. (5) Code execution on the victim's machine. We evaluated the reference implementations – Microsoft Office and LibreOffice – and found both of them to be vulnerable to each tested class of attacks. Finally, we propose mitigation strategies to counter these attacks." />
        <meta name="description" content="OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, feature-rich container formats dating back to the early 2000s. In this work, we present a systematic analysis of the capabilities of malicious office documents. Instead of focusing on implementation bugs, we abuse legitimate features of the OOXML and ODF specifications. We categorize our attacks into five classes: (1) Denial-of-Service attacks affecting the host on which the document is processed. (2) Invasion of privacy attacks that track the usage of the document. (3) Information disclosure attacks exfiltrating personal data out of the victim's computer. (4) Data manipulation on the victim's system. (5) Code execution on the victim's machine. We evaluated the reference implementations – Microsoft Office and LibreOffice – and found both of them to be vulnerable to each tested class of attacks. Finally, we propose mitigation strategies to counter these attacks." />
        <meta name="DC.subject" content="Cyber Security" />
        <meta name="DC.subject" content="Open Document Format" />
        <meta name="DC.subject" content="docx" />
        <meta name="keywords" content="Cyber Security, Open Document Format, docx" />
        <meta name="DC.Identifier" content="https://www.hb.fh-muenster.de/opus4/frontdoor/index/index/docId/12370" />
        <meta name="citation_date" content="2020" />
        <meta name="DC.Date" content="2020" />
        <meta name="DC.rights" content="https://www.hb.fh-muenster.de/opus4/home/index/help#legal_license" />
        <title></title>
        

        <script type="text/javascript">
        //<![CDATA[
            window.opusBaseUrl = 'https://www.hb.fh-muenster.de/opus4';
        //]]>
        </script>


	<!--[if IE 6]>
        <link rel="stylesheet" type="text/css" href="/opus4/layouts/fhmuenster/css/opus-ie.css" />
        <![endif]-->

        <!--[if lt IE 9]>
        <link rel="stylesheet" type="text/css" href="/opus4/layouts/fhmuenster/css/opus-ie-7.css" />
        <![endif]-->

    <!-- Matomo -->
<script type="text/javascript">
  var _paq = window._paq || [];
  /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
  _paq.push(['trackPageView']);
    _paq.push(['enableLinkTracking']);
    (function() {
	        var u="//bibintern.fh-muenster.de/piwik/";
		    _paq.push(['setTrackerUrl', u+'matomo.php']);
		    _paq.push(['setSiteId', '1']);
		        var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0];
		        g.type='text/javascript'; g.async=true; g.defer=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s);
			  })();
</script>
<!-- End Matomo Code -->

    </head>

    <body>
        <div id="container">
            <div id="top-header">
                <div class="wrapper">
                                        <div id="login-bar" class="nav"><a rel="nofollow" href="/opus4/auth/login/searchtype/authorsearch/author/Christian+M%C3%BCller/start/0/rows/1/facetNumber_author_facet/all/yearfq/2020/author_facetfq/Schwenk%2C+J%C3%B6rg/docId/12370/rmodule/frontdoor/rcontroller/index/raction/index">Intern</a></div>
                </div>
                            </div>

            <div id="header">
                <div class="wrapper">
                    <h1 id="logo">
                        <a href="/opus4/home" title="Home"></a>
                        <span class="openaccess-logo">Open Access</span>
                    </h1>
                    <ul id="primary-nav" class="nav">
                                        </ul>
                </div>
            </div>

            <div id="content" class="opus  frontdoor">
                
                                    
                    <div class="wrapper">
                        
<div class="frontdoor">
    
<div class="messages">
    </div>


<div class="frontdoor_pagination">
    <div>

        <ul class="paginationControl">
            <li>
                search hit <span id="pagination-current-hit">1</span> of <span id="pagination-num-hits">1</span>
            </li>
            <li id="pagination-previous">
                                    <div title="Previous Entry"></div>
                            </li>

            <li id="pagination-next">
                                    <div title="Next Entry"></div>
                            </li>
        </ul>
    </div>

    <a id="pagination-link-hitlist" href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Christian+M%C3%BCller/start/0/rows/10/facetNumber_author_facet/all/yearfq/2020/author_facetfq/Schwenk%2C+J%C3%B6rg">Back to Result List</a>


</div>

    <div about="Of&#xAD;fice Do&#xAD;cu&#xAD;ment Se&#xAD;cu&#xAD;ri&#xAD;ty and Pri&#xAD;va&#xAD;cy"><div id="titlemain-wrapper"><h2 class="titlemain" lang="en">Of­fice Do­cu­ment Se­cu­ri­ty and Pri­va­cy</h2></div><div id="result-data"><div id="author"><p><a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Jens+M%C3%BCller" title="Search for other publications by this author">Jens Müller</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Fabian+Ising" title="Search for other publications by this author">Fabian Ising</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Vla%C2%ADdis%C2%ADlav+Mla%C2%ADde%C2%ADnov" title="Search for other publications by this author">Vla­dis­lav Mla­de­nov</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Chris%C2%ADti%C2%ADan+Mainka" title="Search for other publications by this author">Chris­ti­an Mainka</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Sebastian+Schinzel" title="Search for other publications by this author">Sebastian Schinzel</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/J%C3%B6rg+Schwenk" title="Search for other publications by this author">Jörg Schwenk</a></p></div><div id="abstract"><ul><li class="abstract preserve-spaces" lang="en">OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, feature-rich container formats dating back to the early 2000s. In this work, we present a systematic analysis of the capabilities of malicious office documents. Instead of focusing on implementation bugs, we abuse legitimate features of the OOXML and ODF specifications. We categorize our attacks into five classes: (1) Denial-of-Service attacks affecting the host on which the document is processed. (2) Invasion of privacy attacks that track the usage of the document. (3) Information disclosure attacks exfiltrating personal data out of the victim's computer. (4) Data manipulation on the victim's system. (5) Code execution on the victim's machine. We evaluated the reference implementations – Microsoft Office and LibreOffice – and found both of them to be vulnerable to each tested class of attacks. Finally, we propose mitigation strategies to counter these attacks.</li></ul></div></div><div id="services" class="services-menu"><div id="export" class="services"><h3>Export metadata</h3><ul><li><a href="/opus4/citationExport/index/download/searchtype/authorsearch/author/Christian+M%C3%BCller/start/0/rows/10/facetNumber_author_facet/all/yearfq/2020/author_facetfq/Schwenk%2C+J%C3%B6rg/docId/12370/output/bibtex" title="Export BibTeX" class="export bibtex">BibTeX</a></li><li><a href="/opus4/citationExport/index/download/searchtype/authorsearch/author/Christian+M%C3%BCller/start/0/rows/10/facetNumber_author_facet/all/yearfq/2020/author_facetfq/Schwenk%2C+J%C3%B6rg/docId/12370/output/ris" title="Export RIS" class="export ris">RIS</a></li></ul></div><div id="additional-services" class="services"><h3>Additional Services</h3><div><a href="http://twitter.com/share?url=https://www.hb.fh-muenster.de/opus4/frontdoor/index/index/docId/12370"><img src="/opus4/layouts/fhmuenster/img/twitter.png" name="Share in Twitter" title="Share in Twitter" alt="Share in Twitter"/></a> <a href="http://scholar.google.de/scholar?hl=en&amp;q=&quot;Of&#xAD;fice Do&#xAD;cu&#xAD;ment Se&#xAD;cu&#xAD;ri&#xAD;ty and Pri&#xAD;va&#xAD;cy&quot;&amp;as_sauthors=Jens+M&#xFC;ller&amp;as_sauthors=Fabian+Ising&amp;as_sauthors=Vla&#xAD;dis&#xAD;lav+Mla&#xAD;de&#xAD;nov&amp;as_sauthors=Chris&#xAD;ti&#xAD;an+Mainka&amp;as_sauthors=Sebastian+Schinzel&amp;as_sauthors=J&#xF6;rg+Schwenk&amp;as_ylo=2020&amp;as_yhi=2020"/> </div></div></div><table class="result-data frontdoordata"><caption>Metadaten</caption><colgroup class="angaben"><col class="name"/></colgroup><tr><th class="name">Author:</th><td><a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Jens+M%C3%BCller" title="Search for other publications by this author">Jens Müller</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Fabian+Ising" title="Search for other publications by this author">Fabian Ising</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Vla%C2%ADdis%C2%ADlav+Mla%C2%ADde%C2%ADnov" title="Search for other publications by this author">Vla­dis­lav Mla­de­nov</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Chris%C2%ADti%C2%ADan+Mainka" title="Search for other publications by this author">Chris­ti­an Mainka</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/Sebastian+Schinzel" title="Search for other publications by this author">Sebastian Schinzel</a>, <a href="/opus4/solrsearch/index/search/searchtype/authorsearch/author/J%C3%B6rg+Schwenk" title="Search for other publications by this author">Jörg Schwenk</a></td></tr><tr><th class="name">URL:</th><td><a href="https://www.usenix.org/conference/woot20/presentation/muller">https://www.usenix.org/conference/woot20/presentation/muller</a></td></tr><tr><th class="name">Parent Title (English):</th><td class="titleparent" lang="en">14th USE­NIX Work­shop on Of­fen­si­ve Tech­no­lo­gies (WOOT 2020)</td></tr><tr><th class="name">Publisher:</th><td>USENIX</td></tr><tr><th class="name">Document Type:</th><td>Conference Proceeding</td></tr><tr><th class="name">Language:</th><td>English</td></tr><tr><th class="name">Date of Publication (online):</th><td>2020/08/21</td></tr><tr><th class="name">Year of first Publication:</th><td>2020</td></tr><tr><th class="name">Provider of the Publication Server:</th><td>FH Münster - University of Applied Sciences</td></tr><tr><th class="name">Release Date:</th><td>2020/08/21</td></tr><tr><th class="name">Tag:</th><td><em class="data-marker">Cyber Security; Open Document Format; docx</em></td></tr><tr><th class="name">Faculties:</th><td><a href="/opus4/solrsearch/index/search/searchtype/collection/id/16519" title="Browse collection">Elektrotechnik und Informatik (ETI)</a></td></tr><tr><th class="name">Publication list:</th><td><a href="/opus4/solrsearch/index/search/searchtype/collection/id/16446" title="Browse collection">Schinzel, Sebastian</a></td></tr><tr><th class="name"/><td><a href="/opus4/solrsearch/index/search/searchtype/collection/id/16733" title="Browse collection">Ising, Fabian</a></td></tr><tr><th class="name">Licence (German):</th><td><img alt="License Logo" src="https://www.hb.fh-muenster.de/opus4/layouts/fhmuenster/img/whitepixel.png" title="https://www.hb.fh-muenster.de/opus4/home/index/help#legal_license"/><a href="/opus4/default/license/index/licId/12">Bibliographische Daten</a></td></tr></table></div>

</div>                    </div>
                            </div>

            <div id="page-footer">
                <div class="wrapper">
                    <!-- FHMS: kleines OPUS-Logo rechts unten ausblenden -->
                    <!-- <p id="logo-wrapper"><a href="http://www.kobv.de/opus4/" title="Opus4 Website"><img src="/opus4/layouts/fhmuenster/img/logo/logo_small.gif" alt="OPUS4 Logo" title="" width="69" height="29" /></a></p>-->
                    <ul id="secondary-nav" class="nav">
                        <li class="first"><a href="/opus4/home/index/contact">Contact</a></li>
                          <!-- FHMS: Datenschutzhinweis und Impressum der FH verlinken -->
                        <!-- <li><a href="/opus4/home/index/imprint">Imprint</a></li>-->
                        <li class="first">&nbsp;&nbsp;<a href="https://www.fh-muenster.de/impressum/">Impressum</a></li>
                        <li class="last"><a href="https://www.fh-muenster.de/datenschutz/">Datenschutz</a></li>
                        <!-- FHMS: kein Link auf sitemap -->
                        <!-- <li class="last"><a href="/opus4/crawlers/sitelinks">Sitelinks</a></li>-->
                    </ul>
                </div>
            </div>
        </div>

        
    </body>
</html>