Office Document Security and Privacy
summary
Systematic analysis of OOXML and ODF finds five concrete exploit classes: denial‑of‑service using compression bombs that force huge decompression, silent network callbacks and NTLM hash exfiltration via remote image URIs, spreadsheet-cell exfiltration by concatenating cell contents into hyperlinks or webservice calls, xforms writing files to overwrite or delete arbitrary local files in LibreOffice, and macro/config-file escalation to code execution; working PoCs hit both Microsoft Office and LibreOffice and artifacts live on GitHub.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:47Overview
- 1:35History: Office Wars
- 2:23Two competing standards
- 3:09OOXML Directory Structure
- 3:38OOXML Example
- 3:48ODF Directory Structure
- 4:03ODF Example
- 5:21Deflate Bomb
- 6:37URL Invocation
- 7:43Evitable Metadata
- 9:12Data Exfiltration
- 10:22File Disclosure
- 11:30Credential Theft
- 13:19File Write Access
- 14:55Content Masking: OOXML
- 15:47Content Masking: ODF
- 16:32Macros
- 17:12Addition Findings
- 17:35One-Click RCE in LibreOffice
- 18:14Evaluation
- 19:10Countermeasures
- 19:46Conclusion
related talks
51mOffice in Wonderland
25mCommSec D1 - A Deep Dive Into Malicious Documents
43mHunting for Bugs, Catching Dragons
40mLearning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
48m"Sneaking Past Device Guard"
54mBackdoor master key for MS Office
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
01h 03mEffects Malware hunting in Cloud environment