Office Document Security and Privacy

Cite This

Files in this item

Files Size Format View

There are no files associated with this item.

MÜLLER, Jens, Fabian ISING, Christian MAINKA, Vladislav MLADENOV, Sebastian SCHINZEL, Jörg SCHWENK, 2020. Office Document Security and Privacy. WOOT'20 : 14th USENIX Workshop on Offensive Technologies, Aug 11, 2020. In: YAROM, Yuval, ed.. WOOT'20 : 14th USENIX Workshop on Offensive Technologies. Berkeley, CA:USENIX Association

@inproceedings{Muller2020Offic-50777, title={Office Document Security and Privacy}, url={}, year={2020}, address={Berkeley, CA}, publisher={USENIX Association}, booktitle={WOOT'20 : 14th USENIX Workshop on Offensive Technologies}, editor={Yarom, Yuval}, author={Müller, Jens and Ising, Fabian and Mainka, Christian and Mladenov, Vladislav and Schinzel, Sebastian and Schwenk, Jörg} }

<rdf:RDF xmlns:dcterms="" xmlns:dc="" xmlns:rdf="" xmlns:bibo="" xmlns:dspace="" xmlns:foaf="" xmlns:void="" xmlns:xsd="" > <rdf:Description rdf:about=""> <dcterms:abstract xml:lang="eng">OOXML and ODF are the de facto standard data formats for word processing, spreadsheets, and presentations. Both are XML-based, feature-rich container formats dating back to the early 2000s. In this work, we present a systematic analysis of the capabilities of malicious office documents. Instead of focusing on implementation bugs, we abuse legitimate features of the OOXML and ODF specifications. We categorize our attacks into five classes: (1) Denial-of-Service attacks affecting the host on which the document is processed. (2) Invasion of privacy attacks that track the usage of the document. (3) Information disclosure attacks exfiltrating personal data out of the victim's computer. (4) Data manipulation on the victim's system. (5) Code execution on the victim's machine. We evaluated the reference implementations – Microsoft Office and LibreOffice – and found both of them to be vulnerable to each tested class of attacks. Finally, we propose mitigation strategies to counter these attacks.</dcterms:abstract> <dc:creator>Schwenk, Jörg</dc:creator> <bibo:uri rdf:resource=""/> <dc:contributor>Schinzel, Sebastian</dc:contributor> <dc:contributor>Ising, Fabian</dc:contributor> <dc:creator>Müller, Jens</dc:creator> <dc:creator>Ising, Fabian</dc:creator> <dc:contributor>Mladenov, Vladislav</dc:contributor> <dcterms:issued>2020</dcterms:issued> <dc:contributor>Müller, Jens</dc:contributor> <dcterms:title>Office Document Security and Privacy</dcterms:title> <dspace:isPartOfCollection rdf:resource=""/> <dc:creator>Mainka, Christian</dc:creator> <dc:date rdf:datatype="">2020-09-10T12:30:07Z</dc:date> <dc:contributor>Schwenk, Jörg</dc:contributor> <foaf:homepage rdf:resource="http://localhost:8080/jspui"/> <dcterms:isPartOf rdf:resource=""/> <void:sparqlEndpoint rdf:resource="http://localhost/fuseki/dspace/sparql"/> <dc:contributor>Mainka, Christian</dc:contributor> <dc:language>eng</dc:language> <dcterms:rights rdf:resource=""/> <dc:creator>Mladenov, Vladislav</dc:creator> <dc:rights>terms-of-use</dc:rights> <dc:creator>Schinzel, Sebastian</dc:creator> <dcterms:available rdf:datatype="">2020-09-10T12:30:07Z</dcterms:available> </rdf:Description> </rdf:RDF>

This item appears in the following Collection(s)

Search KOPS


My Account