Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: 0Day Exploit Targeting Word, Outlook

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#31

Post by rbanffy »

npizzolato wrote: post #24
lawnchair_larry wrote: post #21

Earlier quoted context omitted.

This is the opposite of the commonly held belief in security.[1] As an attacker, I would invest all of my efforts into finding a 0day in one application, knowing it would work on any machine I choose. If everyone uses different software, say for browsers, there are 3 or 4 major options and a fully reliable exploit (which is rare, but for the sake of argument) will still fail on 25% of targets. Now I need four 0days t…

Do you need 4 0days or 4 targets? I would assume the latter would be the easier thing to get. If that's true, the GPs point has some merit. You just need to find one person running some insecure software and choose him as your target. (I will fully admit I know little about how security works in practice, and would be glad to be proven wrong!)

> just need to find one person running some insecure software and choose him as your target.

The more options they use, the less likely it is the right person will be running the right exploitable client. You need all vulnerabilities aligned to succeed.

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#32

Post by stinos »

dijit wrote: post #6

Everyone in my office runs MS Office for inane reasons, I did try to make them move to openoffice/libreoffice w/ thunderbird, we run an open stack behind the scenes and things simply integrate better.. I feel like this is a massive 'told ya so' after spending thousands of pounds of company money on licenses, now I'll have to spend hours of my time fixing everyones machine one by one, just in case. >_ hopefully a fix…

spend hours of my time fixing everyones machine one by one

probably you could instead spend those on writing an automated solution then run it against all machines?

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#33

Post by danielweber »

npizzolato wrote: post #24
lawnchair_larry wrote: post #21

Earlier quoted context omitted.

This is the opposite of the commonly held belief in security.[1] As an attacker, I would invest all of my efforts into finding a 0day in one application, knowing it would work on any machine I choose. If everyone uses different software, say for browsers, there are 3 or 4 major options and a fully reliable exploit (which is rare, but for the sake of argument) will still fail on 25% of targets. Now I need four 0days t…

Do you need 4 0days or 4 targets? I would assume the latter would be the easier thing to get. If that's true, the GPs point has some merit. You just need to find one person running some insecure software and choose him as your target. (I will fully admit I know little about how security works in practice, and would be glad to be proven wrong!)

Right, if I want into your network, I just need in. I don't need to compromise every single person.

Now if you were discussing resistance to worms, everyone being different helps. It depends on your threat model.

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#34

Post by danielweber »

niels_olson wrote: post #23
mpyne wrote: post #18

Earlier quoted context omitted.

I think the theory is that once you have any beachhead onto a system, that existing local priv escalation exploits and network mapping techniques are almost always sufficient to complete the exploitation of your corporate network. So if you have 5 people using 5 different email clients, all 5 of those must be kept secure from spear phishing or email-viewing vulnerabilities to avoid having a hacker get a beachhead on…

> you only have to keep that 1 safe This argument may appeal to the self-indulgent system administrator who believes he alone knows perfection. In reality, there is no perfection. One must know there are things one does not know. If China is stock-piling zero days against Outlook, how are you to know? In fact, if there is anything we have learned from biological systems, surely it is that when a monoculture falls, it…

I know it's appealing, but don't try too hard to apply biological analogies to computers.

If you are trying to mitigate against all your computers being taken down at once, diversify. If you are trying to keep intruders out of your network, reduce your surface area.

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#36

Post by icantthinkofone »

golergka wrote: post #25
dijit wrote: post #6

Everyone in my office runs MS Office for inane reasons, I did try to make them move to openoffice/libreoffice w/ thunderbird, we run an open stack behind the scenes and things simply integrate better.. I feel like this is a massive 'told ya so' after spending thousands of pounds of company money on licenses, now I'll have to spend hours of my time fixing everyones machine one by one, just in case. >_ hopefully a fix…

As someone who used Word, and especially Excel (for data analysis) pretty intensively — if I couldn't use these tools for work, I'd probably think very hard about finding another job. Excel is miles ahead not only of any competing software, even it's OSX version is very subpar to the Windows one: I used parallels just to run it on my Mac. The usability difference is so big, it's like comparing working with and withou…

Most people don't use Word or Excel anywhere near as you do and only use them cause...cause...er...you're supposed to. Aren't you? Like cause everyone uses Photoshop cause...you're supposed to. Aren't you?

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#37

Post by gtirloni »

dijit wrote: post #6

Everyone in my office runs MS Office for inane reasons, I did try to make them move to openoffice/libreoffice w/ thunderbird, we run an open stack behind the scenes and things simply integrate better.. I feel like this is a massive 'told ya so' after spending thousands of pounds of company money on licenses, now I'll have to spend hours of my time fixing everyones machine one by one, just in case. >_ hopefully a fix…

You tried to make them move to openoffice/libreoffice w/ thunderbird but apparently you failed. Could you share what was the experience like?

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#38

Post by the_ancient »

golergka wrote: post #25
dijit wrote: post #6

Everyone in my office runs MS Office for inane reasons, I did try to make them move to openoffice/libreoffice w/ thunderbird, we run an open stack behind the scenes and things simply integrate better.. I feel like this is a massive 'told ya so' after spending thousands of pounds of company money on licenses, now I'll have to spend hours of my time fixing everyones machine one by one, just in case. >_ hopefully a fix…

As someone who used Word, and especially Excel (for data analysis) pretty intensively — if I couldn't use these tools for work, I'd probably think very hard about finding another job. Excel is miles ahead not only of any competing software, even it's OSX version is very subpar to the Windows one: I used parallels just to run it on my Mac. The usability difference is so big, it's like comparing working with and withou…

Chances are you are the type of person I complain about every day. Using Excel for things it should not be used for....

There are true data analysis tools on the market, Excel is not one of them

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#39

Post by golergka »

the_ancient wrote: post #38
golergka wrote: post #25

Earlier quoted context omitted.

As someone who used Word, and especially Excel (for data analysis) pretty intensively — if I couldn't use these tools for work, I'd probably think very hard about finding another job. Excel is miles ahead not only of any competing software, even it's OSX version is very subpar to the Windows one: I used parallels just to run it on my Mac. The usability difference is so big, it's like comparing working with and withou…

Chances are you are the type of person I complain about every day. Using Excel for things it should not be used for.... There are true data analysis tools on the market, Excel is not one of them

I didn't say that it was the _only_ tool I used. I also regularly used R and SQL.

However, it is the best tool for fast mockups and visualization.

Re: Microsoft: 0Day Exploit Targeting Word, Outlook

#40

Post by golergka »

icantthinkofone wrote: post #36
golergka wrote: post #25

Earlier quoted context omitted.

As someone who used Word, and especially Excel (for data analysis) pretty intensively — if I couldn't use these tools for work, I'd probably think very hard about finding another job. Excel is miles ahead not only of any competing software, even it's OSX version is very subpar to the Windows one: I used parallels just to run it on my Mac. The usability difference is so big, it's like comparing working with and withou…

Most people don't use Word or Excel anywhere near as you do and only use them cause...cause...er...you're supposed to. Aren't you? Like cause everyone uses Photoshop cause...you're supposed to. Aren't you?

No, I used them because I tried nearly all of the alternatives and decided that they were the best for the task at hand.
Post reply on HN