Backdoor master key for MS Office
summary
Claims that Excel 2010/2013 files saved under a specific sequence reuse the same internal secret key (SK) so any file produced that way can be decrypted regardless of password; Microsoft issues a Windows update two weeks after disclosure. Demonstration uses a C++ tool on GitHub (MS Crypto) to extract the SK and decrypt files, shows the bug affects Excel only, not Word/PowerPoint, and includes a fixer to re-encrypt vulnerable files. Attack development involved hooking random APIs (CPGenRandom / detours) and verifying iteration counts like 512 and higher.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 4:05Password encryption basics and flaws
- 10:16Microsoft Office encryption format
- 13:27MS Office Script tool demo
- 14:00Excel encryption vulnerability demo
- 17:21Bug impact and scenarios
- 20:27File format deep dive
- 27:04Backdoor proof of concept and discovery
- 32:38Hardware RNG backdoor risks
- 39:52Trusted format countermeasures
- 44:40Summary and future work
- 46:29Q&A
related talks
51mOffice in Wonderland
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
20mOffice Document Security and Privacy
48m"Sneaking Past Device Guard"
43mHunting for Bugs, Catching Dragons
25mCommSec D1 - A Deep Dive Into Malicious Documents
38mCracking a ransomware family
45mThe Code Behind The Vulnerability