OpenOffice / OpenDocument MS Office 2007 / Open XML PacSec 2006 30/11/2006 http://pacsec.jp Philippe Lagadec DGA/CELAR philippe.lagadec(à)laposte.net
OpenOffice OpenDocument OpenOffice.org Sun StarOffice OOo MS-Office OpenDocument OpenOffice v2 OpenOffice v1 (Koffice, Abiword ) XML ZIP 2006 5 ISO, 2005 OASIS DGA/CELAR 29/11/2006 Diapositive N 2 / 6036
MS Office 2007 Open XML Microsoft Office 2007 Office 12 MS-Office 2006 Open XML Office 2007 (Word, Excel, PowerPoint, except Access) XML * ZIP (?) ECMA (*): sometimes stuffed with bits of binary OLE or BIFF files (it is Microsoft after all) DGA/CELAR 29/11/2006 Diapositive N 3 / 6036
OpenDocument OpenXML : active content????? 2003 F-Secure OpenOffice v1.0 : http://www.f-secure.com/weblog/archives/openoffice_security.pdf DGA/CELAR 29/11/2006 Diapositive N 4 / 6036
OpenOffice.org 2.0.3 2.0.4 OpenDocument v1.0 http://www.oasis-open.org/committees/download.php/12572/opendocument-v1.0-os.pdf MS Office 2007 Beta 2 Technical Refresh Open XML : ECMA v1.4 and (9th Oct 06) http://www.ecma-international.org/news/tc45_current_work/tc45_available_docs.htm Office 2007 Windows XP SP2 fr DGA/CELAR 29/11/2006 Diapositive N 5 / 6036
: :-) OpenDocument : 700 Open XML final draft: 6036!! ;-( VBA macros for example DGA/CELAR 29/11/2006 Diapositive N 6 / 6036
1: : EXE, COM, PIF, SCR, : BAT, CMD, VBS, JS, :, HTML, XML, XHTML : PDF :,, Word, Excel, PowerPoint, Access, :, OLE,, See http://actes.sstic.org/sstic03 (in French, sorry). DGA/CELAR 29/11/2006 Diapositive N 7 / 6036
2: :,,,, (!) DGA/CELAR 29/11/2006 Diapositive N 8 / 6036
Part 1: OpenOffice.org OpenDocument Nom de l entité émettrice 30/06/2005 Diapositive N 9
OpenOffice.org OOo v2 OOo v2 OOo v1 Writer.odt.ott.sxw.stw Calc.ods.ots.sxc.stc Impress.odp.otp.sxi.sti Draw.odg.otg.sxd.std Base.odb HTML Writer/Web (.html).oth (.html).stw Writer.odm.sxg Math.odf.sxm OOo v1 Only OOo v2 Text, Spreadsheet, Presentation and Draw are covered by OpenDocument v1 specifications. DGA/CELAR 29/11/2006 Diapositive N 10 / 6036
OpenDocument ZIP : content.xml: styles.xml: meta.xml: (,, ) settings.xml: Ooo META-INF/manifest.xml: : : JPEG, PNG, SVG, / / OLE DGA/CELAR 29/11/2006 Diapositive N 11 / 6036
OpenOffice OpenOffice v2.0.x 4 : Basic, Javascript, Java (Beanshell), Python UNO : UNO: Universal Network Objects API: OpenOffice. (document open, ). DGA/CELAR 29/11/2006 Diapositive N 12 / 6036
OpenOffice MS Office 2000-2003 4 : ( ): ( ):.. :. : only MS Office 97 OpenOffice 2.0.2 :. DGA/CELAR 29/11/2006 Diapositive N 13 / 6036
OpenOffice DGA/CELAR 29/11/2006 Diapositive N 14 / 6036
OpenOffice OOo Basic Java, Javascript Python Scripts : Basic/Standard/Module1.xml Scripts/beanshell/Library1/MyMacro.bsh Scripts/javascript/Library1/MyMacro.js Scripts/python/MyMacro.py DGA/CELAR 29/11/2006 Diapositive N 15 / 6036
OpenDocument OLE OLE OpenDocument OLEobject (Windows ). OLE object. Microsoft OLE2 ( ) OLE Package ( ). DGA/CELAR 29/11/2006 Diapositive N 16 / 6036
OpenDocument OLE OLE OpenOffice OLE object Windows (packager.exe) Windows (2000 SP4) Windows MS06-065 : OLE object : cmd.exe /c [ bad commands ] /joke.txt http://secunia.com/advisories/20717 DGA/CELAR 29/11/2006 Diapositive N 17 / 6036
OpenDocument HTML : OpenDocument HTML (js or vbs) Java : Java Ooo sandbox OpenOffice 2.0.2 sandbox. URLs: directly launched in the default web browser. Hopefully Javascript and VBscript URLs are not permitted by OpenOffice. DGA/CELAR 29/11/2006 Diapositive N 18 / 6036
MS Office VBA OpenOffice MS Office VBA OpenOffice. VBA OpenOffice DGA/CELAR 29/11/2006 Diapositive N 19 / 6036
ESAT OpenOffice / : De Drézigué, Fizaine, Hansma, In-depth Analysis of the Viral Threats with OpenOffice.org Documents, Journal in Computer Virology, 2006. http://www.springerlink.com/content/1772-9904/?k=openoffice Filiol, Fizaine, Le risque viral sous OpenOffice 2.0.x, MISC magazine n 27, 09/2006. DGA/CELAR 29/11/2006 Diapositive N 20 / 6036
OpenDocument MS Office OOo.,,,, OOo PDF OLE objects DGA/CELAR 29/11/2006 Diapositive N 21 / 6036
Ooo DGA/CELAR 29/11/2006 Diapositive N 22 / 6036
OpenOffice : OpenOffice MS Office OpenDocument OpenDocument ( ) DGA/CELAR 29/11/2006 Diapositive N 23 / 6036
Part 2 : MS Office 2007 Open XML Nom de l entité émettrice 30/06/2005 Diapositive N 24
MS Office 2007 : : Open XML Open XML : Word:.docx,.docm,.dotx,.dotm Excel:.xlsx,.xlsm,.xltx,.xltm,.xlsb,.xlam Powerpoint:.pptx,.pptm,.ppsx,.ppsm Access:.accdb (binary, not OpenXML) (binary OLE2 files): doc, dot, xls, xlt, ppt, pps, Office 2000, XP and 2003 to read/write OpenXML formats DGA/CELAR 29/11/2006 Diapositive N 25 / 6036
Open XML ZIP Open Packaging Conventions (OPC): Microsoft : Open XML, XPS [Content_Types].xml:.RELS files (XML): OPC XML (Word 2007 ): word/document.xml: word/styles.xml: word/settings.xml: docprops/app.xml and core.xml: (,, ) : : JPEG, PNG, GIF, TIFF, WMF, OLE,, DGA/CELAR 29/11/2006 Diapositive N 26 / 6036
Open XML Open XML Office VBA Office 2007 : (default):.docx,.xlsx and.pptx :.docm,.xlsm,.pptm x. Office 2007 DGA/CELAR 29/11/2006 Diapositive N 27 / 6036
MS Office 2007 MS Office 2000/XP/2003 ( ). MS Office 2007 UI :. DGA/CELAR 29/11/2006 Diapositive N 28 / 6036
MS Office 2007 : DGA/CELAR 29/11/2006 Diapositive N 29 / 6036
1 2 4 3 DGA/CELAR 29/11/2006 Diapositive N 30 / 6036
, 3 ( ). =>! : http://blogs.msdn.com/excel/archive/tags/trust+center/default.aspx DGA/CELAR 29/11/2006 Diapositive N 31 / 6036
MS Office 2007 binary OLE2 : Word: word/vbaproject.bin Excel: xl/vbaproject.bin Powerpoint: ppt/vbaproject.bin XML draft 6036 OLE2. : Word 2007 (.docm) Document_Open Word in word/vbadata.xml : <wne:eventdocopen/> DGA/CELAR 29/11/2006 Diapositive N 32 / 6036
OLE Open XML OLE. Excel Word Excel An OLE ( ) OS (packager.exe). DGA/CELAR 29/11/2006 Diapositive N 33 / 6036
OLE Word OLE word/embeddings. OLE ( xlsx in docx). OLE MS OLE2. DGA/CELAR 29/11/2006 Diapositive N 34 / 6036
MS Office 2007 LA RHDtool for Office 2003/XP, OLE DGA/CELAR 29/11/2006 Diapositive N 35 / 6036
MS Office 2007 ( ( ) :, MS Office 2007 (, OLE, ) Open XML : VBA, OLE,.xlsb, (Open XML ) OpenXML Office 2007 Open XML DGA/CELAR 29/11/2006 Diapositive N 36 / 6036
Part 3 : Nom de l entité émettrice 30/06/2005 Diapositive N 37
2 : OpenOffice MS Office 2007 : SMTP, HTTP, FTP proxy DGA/CELAR 29/11/2006 Diapositive N 38 / 6036
OpenOffice MS Office ActiveX,. OLE Package C:\Windows\System32\Packager.exe if DGA/CELAR 29/11/2006 Diapositive N 39 / 6036
OpenOffice :? : :? :, PKI : + : DGA/CELAR 29/11/2006 Diapositive N 40 / 6036
MS Office 2007 ActiveX :. disable all macros except digitally signed if signature is used. And disable the Message bar notifications to block unsigned macros. HKLM. : Currently Office 2007 Beta 2 TR GPO ( Office 2007 Resource Kit ) http://www.microsoft.com/office/ork DGA/CELAR 29/11/2006 Diapositive N 41 / 6036
? DGA/CELAR 29/11/2006 Diapositive N 42 / 6036
OOo Office 2007 OLE. PDF : PDF. DGA/CELAR 29/11/2006 Diapositive N 43 / 6036
Part 4 : OpenDocument OpenXML Nom de l entité émettrice 30/06/2005 Diapositive N 44
/ active content filter ( ) OpenDocument Open XML DGA/CELAR 29/11/2006 Diapositive N 45 / 6036
OpenDocument OpenDocument : : OLE : Object* content.xml : OLE : <draw:object-ole> : <text:script> : <draw:applet> : <draw:plugin> events : <office:event-listeners> DGA/CELAR 29/11/2006 Diapositive N 46 / 6036
Open XML Open XML : : vbaproject.bin vbadata.xml ( vbaproject / vbadata, [Content_Types].xml) : entrymacro, exitmacro, OLE : *.bin ( oleobject ) DGA/CELAR 29/11/2006 Diapositive N 47 / 6036
Open XML Open XML :.docx,.xlsx and.pptx: OK, no macros..docm,.xlsm,.pptm: NOK, macros. OLE.docm.docx ( Word ) :.docm.doc.docm DGA/CELAR 29/11/2006 Diapositive N 48 / 6036
ZIP : OpenOffice: zip d mydoc.odt Scripts/* Basic/* object* Open XML: zip d mydoc.docm *.bin : zip d, whereas! «scripts/*» zip XML DGA/CELAR 29/11/2006 Diapositive N 49 / 6036
Python : ( ) import zipfile, sys try: infile = zipfile.zipfile(sys.argv[1], "r") outfile = zipfile.zipfile(sys.argv[2], "w") except: sys.exit("usage: %s infile outfile" % file ) for f in infile.infolist(): fname = f.filename.lower() if not fname.startswith("scripts") \ and not fname.startswith("basic") \ and not fname.startswith("object") \ and not fname.endswith(".bin") : data = infile.read(f.filename) outfile.writestr(f, data) DGA/CELAR 29/11/2006 Diapositive N 50 / 6036
OpenOffice manifest.xml content.xml : Scripts/python/BadMacro.txt Ooo Scripts Basic DGA/CELAR 29/11/2006 Diapositive N 51 / 6036
Office 2007 Open XML VBA Word : vbaproject.bin dummy.txt word/_rels/document.xml.rels [Content_Types].xml bin by txt! => Office 2007! XML. DGA/CELAR 29/11/2006 Diapositive N 52 / 6036
Open XML «ASCII 7 bit» Internet Explorer Office 2007 XML ASCII (7 ) : 8 «obfuscation bit» : <?xml version="1.0" encoding="us-ascii" standalone="yes"?> ¼HIDDENTAG¾ malware[ ] ¼/HIDDENTAG¾ http://www.securityfocus.com/archive/1/437948 DGA/CELAR 29/11/2006 Diapositive N 53 / 6036
Open XML UTF-7 UTF-7 : <?xml version="1.0" encoding= UTF-7" standalone="yes"?> +ADw-HIDDENTAG+AD4- malware[ ] +ADw-/HIDDENTAG+AD4- ECMA, Open XML UTF-8 or UTF-16 encodings! UTF-7 US-ASCII MS Office 2007 (OpenOffice XML ) DGA/CELAR 29/11/2006 Diapositive N 54 / 6036
ZIP ZIP ( ) : ( ) ZIP : DGA/CELAR 29/11/2006 Diapositive N 55 / 6036
ZIP : File 1 Name: Document.xml, size: 4000 File 1 (compressed) File 2 Name: vbaproject.bin, size: 1024 File 2 (compressed) File 3 Name: HiddenMalware.exe, size: 16000 File 3 (compressed) Central Dir File 1: Document.xml, size: 4000 File 2: nothing.xml, size: 1024 File 3: nothing2.txt, size: 0 DGA/CELAR 29/11/2006 Diapositive N 56 / 6036
OOo and MS Office 2007 ZIP OpenOffice ZIP : ZIP / MS Office 2007 ZIP! / DGA/CELAR 29/11/2006 Diapositive N 57 / 6036
/ ZIP ( ) (Zip64,, ) XML XML (UTF-8, ) ( ) XML (XSD, RNG) XML : Open XML named.doc, easier said than done. ;-) DGA/CELAR 29/11/2006 Diapositive N 58 / 6036
Nom de l entité émettrice 30/06/2005 Diapositive N 59
OpenOffice OpenDocument MS Office 2007 Open XML (1) ZIP XML, OOo: 1 Office 2007: 3 OLE (MS OLE2 ) OS DGA/CELAR 29/11/2006 Diapositive N 60 / 6036
OpenOffice OpenDocument MS Office 2007 Open XML (2)( Open XML OpenDocument (,,, ) / OLE PD (ZIP, XML) DGA/CELAR 29/11/2006 Diapositive N 61 / 6036
OpenDocument Open XML :, ZIP, XML OpenOffice Office 2007, OLE, HTM,, ActiveX, DGA/CELAR 29/11/2006 Diapositive N 62 / 6036
: Some ZIP XML ( ) Office 2007 DGA/CELAR 29/11/2006 Diapositive N 63 / 6036
ZIP XML OOo MS Office ( ZIP/XML, OLE, ). DGA/CELAR 29/11/2006 Diapositive N 64 / 6036
The End <??> See http://pacsec.jp/pastevents.html for updates DGA/CELAR 29/11/2006 Diapositive N 65 / 6036
( ) DGA/CELAR 29/11/2006 Diapositive N 66 / 6036
PowerPoint 3D OLE Excel! ;-) DGA/CELAR 29/11/2006 Diapositive N 67 / 6036
: MS Office 97-2003 API ( / ) OLE cmd.exe,,,,,, DGA/CELAR 29/11/2006 Diapositive N 68 / 6036
OpenOffice - UNO UNO UNO: Universal Network Objects API: OpenOffice UNO (C++,.NET, Java, Python, ) OpenOffice UNO ( ) DGA/CELAR 29/11/2006 Diapositive N 69 / 6036
OPC: Open Packaging Conventions Open XML OPC files: ZIP XML ( ) relationships ( ).rels XML OpenDocument OPC : XPS: Microsoft PDF DGA/CELAR 29/11/2006 Diapositive N 70 / 6036
Excel 2007.xlsx : ( ).xlsm:.xlsb: XML.xlsx/.xlsm ZIP XML (BIFF ) (.rels),, (.xlsm ) DGA/CELAR 29/11/2006 Diapositive N 71 / 6036
Office HTML MS Office 2003 HTML ( ) HTML/MHTML OpenOffice MS Office 2007 B2TR HTML Open XML Office 2007 Office2003 HTML DGA/CELAR 29/11/2006 Diapositive N 72 / 6036
Office 2007 «MS Office / VBA» OpenOffice VBA / DGA/CELAR 29/11/2006 Diapositive N 73 / 6036
/ :. (Word ): C:\Program Files\Microsoft Office\Templates Writable by administrators and power users only C:\Documents and Settings\user\Application Data\Microsoft\Templates Writable by user only C:\Documents and Settings\user\Application Data\Microsoft\Word\Startup Writable by user only MS-Office HKCU HKLM DGA/CELAR 29/11/2006 Diapositive N 74 / 6036
HTML : UTF-8 encoding ( ASCII ) <SCR<script>remove me</script>ipt> DGA/CELAR 29/11/2006 Diapositive N 75 / 6036
.NET API: System.IO.Packaging The new System.IO.Packaging API provides Open Packaging Conventions files access to.net applications. Open XML and XPS documents. Allows to develop Open XML security filters. For example, Microsoft provides a VBA removal code snippet. Windows OpenDocument DGA/CELAR 29/11/2006 Diapositive N 76 / 6036
OOoPy OOoPy OpenDocument Python ZIP / XML. Open XML. DGA/CELAR 29/11/2006 Diapositive N 77 / 6036
ZIP ZIP Open XML Zip64 compression ZIP. DGA/CELAR 29/11/2006 Diapositive N 78 / 6036
XML OpenDocument Open XML XML (XSD or Relax-NG). XML XML XML OpenXML Markup DGA/CELAR 29/11/2006 Diapositive N 79 / 6036