Microsoft Word Is Under A Hack Attack: Do Not Open Documents Named '.RTF'

[Tsiyu]

Source: Yahoo News

Microsoft Corp. on Monday issued an emergency security warning saying that hackers have found a way to booby-trap certain common Word files with the .rtf extension.

Microsoft says it's aware of attacks going on now, but there's no fix yet to stop the hackers. It's working on a way to stop the bug.

The only way to be sure your computer won't get infected is not to open a document with the .rtf file extension until Microsoft says it's fine to do so.

This is the worst kind of attack. A hacker who manages to get you to open a booby-trapped file can gain control of your computer. From there, the hacker can do all kinds of things. For instance, the hacker can turn your computer into a so-called zombie by putting it on an illegal botnet. That means hackers can use your computer as part of a bigger network of computers to do all kinds of illegal things — like send spam, spread viruses, and commit fraud.


Read more: http://finance.yahoo.com/news/microsoft-word-under-hack-attack-184132816.html

---

Microsoft says in the article to block any .rtf files from your computer. There is a link to a download at the link above.

DON'T view in Outlook either.

Stay safe, DU 'puters!

Hosts, if this is a dupe or not SOP for this forum, please lock.

[pffshht]

1. Better yet, block MS Word and Outlook from your computer

http://www.openoffice.org
http://www.mozilla.org/en-US/firefox/new/

[Tsiyu]

2. good advice

Of course, some on work computers can't do that.

[pffshht]

5. I know but come on, the people in charge of IT at those workplaces need to get a clue

or retire and let someone with a clue take over.

-Can't install any third-party software for supposed security reasons.
-Standardize on the most proven-exploitable software out there.
-Problem?

[ET Awful]

12. People in charge of IT aren't often completely in charge of large corporate software decisions

Often, we can only make suggestions that the owners/managers can chose not to invest time or money in.

If a company has 10's or 100's of thousands of dollars in software, training, licensing, customized add-ons, etc., they're very, very unlikely to change course.

Blaming the IT folks for things like this is like blaming a supply sergeant for decisions made at the Pentagon.

[RobinA]

20. Yep!

Microsoft is often in charge of large corporate software decisions.

Not an IT professional, just someone who USED to like to use LotusNotes when I worked for a large computer company, only to have to yanked off our desktops due to an agreement with....Microsoft. Monopoly much?

[Renew Deal]

36. Outlook is a better mail client than Notes

By a lot. And the default format for Notes mail is RTF. It is legacy technology that IBM and Apple have saddled us with.

[ET Awful]

47. Outlook also has far better calendaring capabilities.

Notes/Domino is excellent as a database (or application as they call it in newer versions) server, but for mail and calendar use, it is lacking.

On a side note - it took me all of 15 minutes to create a new group policy in my domain which made it so RTF files can only be opened in "protected mode" which would prevent any potential problems.

[RobinA]

55. Notes Still Exists?

Like I said, I'm not IT, just a user. We had LotusNotes as our first e-mail software back at the beginning. Then we were forced to go totally Microsoft and we got Outlook (or whatever it was back then, this was early '90's). It was a total clunker compared to Notes. No calendar software has ever convinced me it is better than...an actual calendar, so I don't know about that. And I figured out how to a bunch of stuff with the database it couldn't do, so a nonITer could actually make it work the way she wanted it to work. That was gold.

[ET Awful]

60. Yup, we use it for lots of things, just not e-mail and calendaring

Little tip - If you need to coordinate calendars between lots of people, a paper calendar doesn't really cut it, if your entire organization has their calendars in a system like Outlook (or even Notes), you can tell at a glance who is available at what time if you need to schedule a meeting with lots of people.

[jtuck004]

88. In the 1990's? I give you Windows 3.0.

That's setting the bar pretty low.

Not laughing at you, that just brings back memories.

In those same years you could download linux from a bbs, or get it on disks fro a friend or a store, but you had to compile it yourself just to get it to run on your machine. None of this install and go like it does today.

Your Notes was likely running on a well-engineered Novell Network, most likely, (back when people thought well-engineered would always sell better) a network that was about to become, relatively speaking, history, because of that crappy little Windows 3.0 program. Anyone could get a compiler and write software for that, and they did. Some of it was very, very bad, but they sold it anyway, and some was good. Something that was much harder to do with anything else.

We have come a long, long way since then, whether it's PC or Linux. And Mac did something too.

Anyway, thanks for that.

[liberal N proud]

16. Microsoft has the pockets of the corporate IT decision makers

In some cases, they have invited Microsoft in to manage their software and worse yet network security.

[ET Awful]

48. Actually, most companies use Microsoft in order to be compatible with what their network of clients,

customers, parent companies, etc. use.

For instance, I work for a small Pharmaceutical company. In order to be compatible with suppliers, customers, the FDA, other regulatory agencies, etc. and in order to use industry standard document templates, Microsoft is almost a necessity, it would be almost impossible for us to function without MS products.

[rbixby]

53. What would someone with a clue install in a full on corporate environment?

Just curious, considering 90 some odd percent of the computers out in the corporate world use Microsoft Office.

[ellenfl]

26. isn't mozilla's email host still thunderbird?

i use firefox and wordperfect but have to use outlook in the office. i hate outlook. i don't understand why people don't know to send text attachments as pdfs. i am constantly telling people to convert the word document they send me to pdf format and re-send. i'm 64 years old and i know how to do that!

this alert is only for rtf documents that you might open in word? is that what i'm hearing here?

tia

[rbixby]

54. I believe that Mozilla ranks last in browser security still as well

And Chrome just works better

[ellenfl]

57. but doesn't chrome share your info? i don't google anymore for that reason.

i disagree with your characterization of mozilla as being last. i think internet exploder is last. do you have confirmation of that? i would like to know my risks. haven't had a problem with firefox since i started using it many years ago.

[KurtNYC]

3. Thanks

Just searched and found only old "readme" and, ironically, EULA files that are in RTF

Also, looks like this is ONLY if you use Word to view emails (?!):

http://it.slashdot.org/story/14/03/25/0156203/microsoft-word-zero-day-used-in-targeted-attacks

http://www.securityweek.com/new-microsoft-word-zero-day-used-targeted-attacks

[Tsiyu]

4. De Nada

hard to keep up with all the idiots and their schemes out there.


I believe it is a word/outlook express/ microsoft issue exclusively.

[toddwv]

34. Not completely correct.

If you use Outlook, which uses Word to view .rtf files by default, the preview feature cold also lead to infection.

[davidpdx]

6. Craaaaapp

I'm not going to be downloading anything for awhile. The last thing I need is a virus.

[Berlum]

7. MS = headaches

[Thor_MN]

8. Rich text files? Haven't seen one in ages.

A format that was largely made obsolete by advances in storage. Designed to fit somewhere between text files and full blown word processing documents, they allowed the use of different font sizes and some formatting. As hard drive space made the size overhead for a word processing document negligible, the purpose for rtf files went the way of the dinosaur.

Better advice would be don't open anything from a source you don't trust or know exactly what it is you are opening. My company is currently without web access to our email because some idiot clicked a link that was obviously a phishing attack. Well that and the fact that the email team screwed up and left some gaping holes...

[ashling]

25. This may be true in business

but as an online college professor I get them fairly frequently from students,

I put in my syllabus that I require everything in doc docx or PDF. Still get them though - never read them. You don't submit in the correct format - you get a zero.

[thesquanderer]

40. I dont think RTF was designed for storage space reasons

As I recall, the issue was that, in the old days, if you wanted to send a document to someone else, and they didn't use the same word processing program you did, the only thing you could do was convert to plain text and lose all formatting. You couldn't open a Word doc unless you owned Word, etc. So for example, RTF would allow a Word user to send their document to any Mac or Windows user who didn't have Word, and they could still see a reasonably well formatted version of the document.

The RTF was basically made obsolete by three things: the ability of numerous apps to read native Word files; the fact that Word itself has become so much more ubiquitous; and the rise of PDF. Sending Word docs to people and worrying about whether or not they will be readable is not as big an issue as it used to be. The bigger issue is probably one of whether it will necessarily appear as expected, and PDF addresses that issue much better than RTF ever did.

[Thor_MN]

61. For as long as Windows has existed, word processing programs knew each other's formats

[greyl]

68. Wow, that's false! nt

[Thor_MN]

70. I installed Windows 2.0 when it was new.

I set up the first PCs in the company I was working at (by then, it was Windows 3.0) The two dominant word processors were Word Perfect and Word and they could read and write in each others formats, if you knew how to install them properly.

If you are talking other OSes, then yeah, there might have been some fringe word processors out there that couldn't talk to anything else. We didn't bother with no name $5 floppy disk software with a dot matrix printed label.

[Tommy_Carcetti]

41. I save in RTF at times.

It's useful when you are using a computer with a newer Word version and you need to send it to a computer with an older Word version.

[Thor_MN]

62. Word has forward and back compatible formats available.

Might want to use them, at least until they get this patched.

[Lasher]

9. Microsoft has a temporary fix for this.

Go here and follow the "Fix it for me" instructions to disable opening of RTF content in Word.

[cui bono]

10. This is only for NEW .rtf files you receive, right?

Or existing ones you already have on your computer? Seems like it has to be only new files.

Can anyone confirm just to be safe?

Also, is it only for pc or also for Macs?

[Tsiyu]

11. I have no idea

but I will kick as someone may know

[Renew Deal]

32. I took it as new

Not sure if it affects non-windows systems or Word for Mac

[ManiacJoe]

65. Yes, new RTF files.

The baddies in the RTF cause a Visual Basic script to be installed and run.

[DonViejo]

13. Thanks Tsiyu, for posting this important information...

much appreciated! I copied the article and sent it out to my mailing list. Thanks again!

[Tsiyu]

14. no problem

I just wonder why we didn't learn of this when they issued the alert on Monday. better late than never, though!

have a great one DonViejo

[ananda]

15. So this is basically an email problem.

Geez. I don't even know what rtf is.

[Tsiyu]

17. rich text format

seems like some writing I sent somewhere recently had to be formatted that way for some reason or other, but it isn't very popular for the most part

I guess hackers are using that format to... well, hack, so if you see an attachment ending in .rtf, just don't open it. I have a great graymail program on my tele co-op e-mail. they catch everything and quarantine. You have to forward an e-mail to regular inbox to open suspicious stuff.

[bemildred]

24. RTF is, in theory, a portable document format, like PDF/Acrobat.

In practice, it lacks the tools for serious work, but it can be convenient for casual use, and I've seen it at times in academic situations, like for students with different computing platforms.

And it's old, been around since forever. One thing hackers will do is root around in the detritus of past operating systems looking for cool things you could do before the the internet became The Internet.

[hobbit709]

18. Surprise, surprise, surprise!

A crappy word processor combined with an even crappier email program, both from the people with the least security conscious OS.
I'm surprised that Word will even open a .rtf considering that it won't even open old versions of it's own documents.
An email program where the default used to be "Automatically open attachments". Change the settings and along comes an M$ update that resets to default without asking or telling you.

[AtheistCrusader]

29. The last zero-day exploit of Word was in 2007.

And that was older versions of it. It's not exactly swiss cheese.

And auto-open, good grief, are you pissed about Outlook 97 still? Do you even own a car that old?

[hobbit709]

30. As a matter of fact I drive a 1992 Toyota pickup.

It's paid for, has 136K miles on it and gets 31 mpg on the highway.

And I stand by my statements about Orifice and Outhouse.
And if it's not swiss cheese, why are there literally hundreds of patches and fixes for it?
Of course, I've made a fair amount of money straightening out people's fucked up computers.

[AtheistCrusader]

31. Well, it is the flagship app for Office.

And it is used worldwide, so it is constantly under assault. Sure, there have been some vulns. the JPG filter, PNG filter, now the RTF import filter. Some macro viruses (largely nuked in '97 SR1).

It's been pretty solid though. Most of the fixes for it, have nothing to do with security. Some are as innocuous as adding new currencies, or deprecating old ones.

Sorry about the car joke though, that was a cheap shot. High-five, older, somehow more efficient pickup buddy.

[tofuandbeer]

44. off topic, but dang...that's low miles for a 1992 vehicle!

[ellenfl]

59. i have a 95 camry with <90,000 miles. just can't give it up. eom

[tofuandbeer]

73. I have a Corolla and love it, but wow! You guys are doing good with mileage!

[ellenfl]

79. i always rent a car for trips. keeps the wear and tear from my car.

it would be nice to have a car with a cd player in it however. do they still make those? i have avoided buying new cars because of all the new gadgets. i wish i could find a fully-manual car but that's impossible nowadays.

i DO love my camry . . . especially with the v6 booster.

[tofuandbeer]

86. Yeah, wish I had a Camry. :) We rent on trips too...but I guess we didn't when the car was younger.

[IDemo]

66. My 93 Toyota pickup is just shy of 70k miles n/t

[ellenfl]

80. that's impressive! is it your only car? eom

[IDemo]

85. No,

I have always commuted by bike or motorcycle during rideable weather. Mainly though, we're just home-bodies.

[hunter]

81. I drive a mid 'eighties car.

That's about when my wife and I quit the Los Angeles commutes.

We've been fortunate that we've been able to avoid the automobile commuting lifestyle ever since.

I rather resent that this society expects us to have automobiles for quite ordinary sorts of errands.

Most of us ought to be living in places where automobiles are unnecessary.

[Jesus Malverde]

19. People weren't getting rid of XP eh?...nt

[hobbit709]

21. the main problem has always been the ID ten T error.

The only virus I ever got was from a disk from someone I trusted so I didn't scan it first.

But I have cleaned out 1000's of computers.

[Erich Bloodaxe BSN]

28. I got sloppy once.

Was on an unsafe site, with what I suppose was a cross-site scripting attack, and distractedly clicked on something I shouldn't. Completely did in the windows OS on that hard drive, couldn't boot up. But I was able to simply mount the drive under a linux partition and grab off all the rest of my data on the drive, thankfully.

[steve2470]

42. user error = number one problem

You get careless on the net, you get a virus. Simple.

[Orrex]

22. This is actually a terrific opportunity

People have been getting desperate. It's been about 15 minutes since they had a chance to squawk about Microsoft.

[bemildred]

23. Fortunately, I only use Linux on the web. Microsoft is not safe in the wild. nt

[Renew Deal]

33. Actually, Linux is even less secure

Your system may be owned as we speak

http://m.infoworld.com/t/cringely/the-linux-security-spell-broken-238717

[bemildred]

35. Sure it is.

According to ESET, Windigo isn't exploiting an undiscovered weakness in Linux or OpenSSH. This thing has to be manually installed, which means the wart-spouting troglodytes cracked the credentials of up to 25,000 servers, most likely remotely unless they've been faking their way into data centers worldwide wearing janitor uniforms and reading the passwords that were probably taped to each server bezel. Those admins, much like my poor reader who shall remain nameless, seem to be of the same mind: Linux is Unix as well as little-used, so we don't have to worry about serious security.

It's social engineering, it's always social engineering.

[Renew Deal]

38. Remember the I Love You virus?

Infected computers would send it to contacts in the address book, so people would receive these messages from people they knew. Brilliant!

[bemildred]

39. Oh yeah.

Security is always too much trouble.

Personally, my prescription is either:

a.) Build a secure web for secure interactions, with industrial encryption built right in (and make the banks pay for it),

or

b.) Stop putting anything not intended for EVERYONE to see on the web.

You are always communicating with EVERYBODY on the Internet.

I predicted in the 90s that putting all that financial stuff on the web would be a security disaster. The internet assumes trust. Security is an added feature.

In the 90s, before Y2K and security consciousness, you could do amazing things on the net, FTP or TELNET just about anywhere, for example.

[cprise]

71. Hmmm.. Have to disagree with your trust comment

Properly designed systems assume the Internet is un-trustworthy.

The real locus of security always did reside in the endpoints (e.g. in the PCs and in-house servers, but not the cloud or the routing infrastructure). There's really no other way to do security without rank authoritarianism.

OTOH, most PCs run Windows therefore security is sh!t. Cyber criminals became rich, resourceful and established on the back of Microsoft's penny-pinching attitude toward security (up to Vista at least).

The most interesting and practical thing to come along in security for a long time may be Qubes OS, the first desktop OS to have virtual machines (and advanced VM hardware features) ingrained into its architecture.

[bemildred]

74. It is not rank authoritarianism, it just doesn't work at all, it won't scale up.

Centralized architectures don't scale well. Even DNS is really too centralized, but the centralized part is as small as possible, and there are local caches, so it works as long as most traffic is "local", where "local" means you don't have to look to far up in the server hierarchy. Web traffic generates lots of lookups, Point to point generates few or none.

[cprise]

77. Only when building-out. It does eventually scale if you have 4 corps. running all

...of the last-mile stuff.

They used to say that pervasive electronic surveillance was impractical, too.

Anyway, my point is that the IT community should not forget the importance of personal computers. We won't make anything more trustworthy until we make PCs more trustworthy.

[bemildred]

78. I'm talking about the web, a global network.

In more limited domains, you don't get the same performance issues. How often have you been left hanging there on the web waiting for DU to respond? How much worse would it have to be to make the web unusable for converstation?

You can collect it all, but you can't process it in real time. They are running around like striped-ass apes as we speak trying to build out enough storage to collect it, let alone do something with it.

I quite agree with your point, I'm saying it's the only way you can do it (security), per machine. That's why they want us to pay for it, it's going to be expensive, in time, and in inconvenience, and in money.

[TroglodyteScholar]

63. "Even less secure..." ...really??

Maybe the sarcasm tag failed to load in your post or something. One primitive trojan in the wild makes Linux less secure than Windows? lol

If that was even remotely true, a trojan wouldn't have even been news.

So this is really only a hypothetical threat to me since I'm not vulnerable to this particular attack... and even if I was terrified by this sign-of-the-endtimes, I may find salvation by inputting one simple command in the terminal to determine whether I'm compromised:

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo “System clean” || echo “System infected”

Boy, that was scary. Better go back to Windows, where antivirus and antimalware necessarily consume half of any system's resources.

[Erich Bloodaxe BSN]

27. Can I assume .rtf is safe in Open Office under linux?

ie, the attack is specifically geared at the windows operating system? Or is it something that spans platforms?

[bemildred]

37. It seems to be Windows specific.

I would assume, if you are not root and on Linux, that you can't do that much damage, and the operating system stuff would not work at all.

[Kablooie]

43. One word... Macintosh.

No problems with Word or Outlook for us.

But I hear Libre Office is a good alternative.

[cui bono]

49. Can you confirm that?

I have both a pc and a Mac and I use Word on the Mac and OpenOffice on the pc.

I tend to use .rtf files more on the Mac than pc.

Did you read somewhere that it's only for pc version of Word?

[Kablooie]

51. They say the vulnerability is in Office 2011 for Mac but ...

first someone would have to write a custom hack to get into the Mac.
One of the reasons there are no Mac viruses is because it is very difficult to do and there aren't enough Macs in the world to make it worthwhile, compared to the the relatively easy methods to break into a PC and the huge volume of machines available.

Also the hack must exploit admin privileges which can't be done on OS X without the user explicitly giving the code permission by typing in the admin password. If you try to open a text file and then get a message asking to be given admin privileges instead of opening the file, it's pretty unlikely most people would do it.

[cui bono]

64. Okay, thanks.

[tofuandbeer]

45. I actually use RTF files. I get tired of waiting for Word to open, so for simple

text files I like them to open in Mac's Simple Text (or whatever it's called now, not on my Mac right now).
Also, some online job applications want your resume in non-formated text, so I have some resumes lying about in RTF for quick copy and paste.

[bemildred]

76. +1. Nothing is quicker or more portable than plain text. nt

[PasadenaTrudy]

46. Is this

through email? Are they saying don't open .rtf files that someone sends you? Confused, thanks!

[Bosonic]

50. Microsoft finally unveils Office for Apple's iPad

Microsoft finally unveils Office for Apple's iPad

(Reuters) - Microsoft Corp's Office suite of applications, encompassing its popular Word, Excel and PowerPoint programs, will become available to iPad users from Apple Inc's app store from Thursday.

The expected announcement marks a significant break with Microsoft's longstanding Windows strategy now that new Chief Executive Officer Satya Nadella has taken the helm. The software giant has previously been unwilling to compromise its signature PC operating system.

At a news conference Thursday, Microsoft executives demonstrated a new "touch-first" version of Office crafted for the iPad, available for download as a free app this morning, although a subscription is needed to let users create or edit documents. Significantly, executives did not demo any software on Windows machines.

While the technology behind the software is not ground-breaking, the strategy is: It puts Office at the heart of the company's push to become a leading services company across a variety of platforms - possibly at the expense of Windows and its own Surface tablet.

http://www.reuters.com/article/2014/03/27/us-microsoft-office-ipad-idUSBREA2Q1MV20140327

[alp227]

52. use openoffice instead. and original Business Insider story

http://www.businessinsider.com/hackers-are-attacking-microsoft-word-2014-3

[valerief]

56. It's not clear to me if the rtf file under attack are only Word/Outlook files. Other apps use rtf

files, too. Are they subject to attack?

[freshwest]

58. Guess this is a Microsoft issue. I'm amazed that any Microsoft computers read RTF.

But I joined the Cult of Mac years ago and have not gone back, as Mac does what I want it to do, despite the limitations. I know Microsoft runs many great applications Mac cannot.

I don't send RTFs, only pdf's and inline messages. I never thought Microsoft accepted them. So this is news to me. I've thouught of purchasing a Microsoft laptop simply to run Rosetta Stone, as I have not found a version that works with my Mac.

My computer can't work with Microsoft OS files, which can be a hassle, not being able to work with or exchange any Microsoft Word files. I had a program called Open Office to do so, but it tried to make itself the default, which ruined my existing RTFs, so I deleted it.

I use Mac OSX and convert and create ALL my files to RTF. They won't save as RTF files after editing to add images, so I save them as RFTD files.

Thanks for this bit of news, as it shows Microsoft is more open to other files. I haven't used it for over ten years, and I know I've missed a gteat deal. Very good of you to post this.

[IDemo]

67. MS Wordpad is still around in Win7 and has always defaulted to RTF n/t

[freshwest]

69. My last MS OS was windows 7 But I never used Wordpad. Thanks for the info. Just wish I could get RS

to work on a Mac. I'm still willing to use MS in a laptop just get that language program. Other than that, I have no use for using MS again.

[AtheistCrusader]

72. Word 97 could open and save RTF.

I don't recall if Word 2.0 could or not. I think it could. (Last Windows version of word before switching to the Office/date versioning name scheme)

[bemildred]

75. RTF goes back to DOS if I'm not mistaken. nt

[AtheistCrusader]

83. That's what I was thinking but I genuienly cannot remember anymore.

Haven't seen word for dos since the Word for dos 5.5 patch for Y2K.

[bemildred]

84. I used to know DOS pretty well, though it's all foggy now.

But I'm pretty sure RTF was around, they used it for documentation and had a free editor for it, so people without Word could still read the documents. "Microsoft Write" maybe it was. They always liked to adopt vague words for product names, like "Windows". Word was the bells-and-whistles word processor you paid money for. At that time I was using mostly text editors, so I didn't care about Word, and graphics monitors were expensive too, but I used Write a lot, it ran fine on a text console.

[hunter]

82. How the hell does a screw-up like this happen?

Rich Text Format is an absurdly simplistic Microsoft rip-off of TeX. Which demented Word "feature" is allowing RTF documents to generate executable objects?

[aroach]

87. I have an English professor

who insists that all assignments be submitted as .rtf files. Via email. I suppose I should give him a heads up.