10 ms·
Office Drama on macOS
- bartvk 6y agoWhat I find funny, is the quote: "Specifically we’ll show how we were easily able to [...]". And then the article consists of 3647 words :) I'm actually quite amazed, and happy, how far security has come.
- bfuclusion 6y agoYeah, but that's like 12 pages of text. 12 pages is a trivial amount to read for a step by step guide on how to own millions of machines.
- saagarjha 6y agoIt’s mostly images too, and the bugs are fairly straightforward to understand.
- sixhobbits 6y agoI write a lot of tutorials and guides and I strongly agree and disagree with this comment at the same time. a) Yes, the words "simply", "obviously" etc are waay overused in this kind of writing and when editing it's often simply a case of doing a find and replace to remove them all (obviously after checking each one to make sure it still makes sense) b) 3500 words is not a lot of text. Somehow marketing people managed to convince the world that a "long form" blog post is 500 words. In reality, 2000 words is often a ballpark minimum to say something useful and interesting, and 10000 word articles are often super useful (and still not that long given how easy it is to skim over bits of text, how fast text can be produced and how lightweight text is in terms of bandwidth and storage space.)
- sukilot 6y ago> obviously after checking each one to make sure it still makes sense Did you? > 3500 words is not a lot of text. The comment was regarding whether it's "easy".
- orionblastar 6y agoThanks for the heads up. Would using LibreOffice be safer?
- gruez 6y agoYes, in the same sense that browsing the web with lynx is safer because there's no javascript to exploit. Some people even consider the lack of javascript to be a feature. If you're just opening documents for viewing/basic editing, you probably won't mind macros being missing. The bigger problem might be the inconsistent layout (and other compatibility issues) that you get.
- EE84M3i 6y agoLibreOffice fully supports a lot of macro features, so I'm not sure what you're refering to about "macros being missing".
- anthk 6y agoLO supports some macros. Also, I use Lynx/Links+ (and a upgraded Netsurf) because of those JS pests. So far I can: - Use pleroma (Mastodon) from https://brutaldon.online https://brutaldon.online. Much faster than any JS bloated platform. Images are viewed externally from sxiv, nothing is lost. - Search YT from Idiotbox and playing the video with mpv + youtube-dl. - Read Medium/Tedium general news articles without bogging my CPU down. Links -g supports images. - Comment here. - For Reddit I use either TUIR or Gopher. - I can avoid all malicious cookies too by setting a different config file for links and tunneling it thru torsocks. For DOCX/XLSX files, you can use antiword/wv and convert the DOC/X file to RTF and then open it under Ted (a really lightweight WP), and sc-im plus gnuplot for spreadsheets. Much faster and secure. On potentially malicious PDF's and PostScripts, convert them into DJVU and use DJView to read them.
- 9935c101ab17a66 6y agoThis attack only works if the user clicks 'enable macros' when the document is opened or when the "“Disable all macros without notification" setting is enabled (ironic) or if you are using Office 2011. TL;DR: Looks like most of the exploits have been patched, and even still, if they hadn't been patched you probably would have been fine using later versions of office (at least in the context of the attacks outlined) if you don't open and run documents with macros and you don't have that setting enabled.
- acomjean 6y agoUgg.. I have macOS 10.12, and office from work. I get prompts to update word, which then tell me to update the OS... Good times. I probably should shift to libre office exclusively...
- ilikepi 6y agoWe have an old iMac running 10.11. I use an old version of Numbers on it, and it regularly prompts me to say there is a new version of Numbers available. If I search for Numbers in the App Store, it says it requires 10.13 or higher. ¯\_(ツ)_/¯
- gumby 6y agoI wonder if you tried to download it though if it would give you the latest version for your os.
- ilikepi 6y agoIf I click "Update", I get a spinner in the upper left of the App Store window, but nothing appears to happen otherwise.
- xenonite 6y agoLucky guy, 10.11 is the last to decently display PDFs. I am still on 10.11 only because of that (I am an academic, reading and writing papers).
- ArgyleSound 6y agoI'm unaware, what is the issue with later versions?
- Angostura 6y agoLikewise. On 10.14 here - what are the issues?
- RcouF1uZ4gsC 6y agoFrom Wikipedia article on the sylk format which the exploit uses. > The format was introduced in the 1980s and has not evolved since 1986[2]. So over 34 years old.
- deathanatos 6y agoLikewise, the macro format XLM — which the article notes is a predecessor to VBA (at which point I'm going, "VBA had a predecessor? but VBA is ancient — its still supported?!") — XML was introduced in 1987, 33 years ago. VBA wouldn't happen until 1993. Absolutely incredible.
- Beldin 6y agoIf with "VBA" you mean Visual Basic for Applications, it had (AFAIK) several ancestors from the BASIC family including Visual Basic and Quick Basic. Probably GW BASIC and its ancestors count as well.
- taejo 6y agodeathanatos seems to be referring to predecessors as a document macro system, not ancestors as a programming language
- flomo 6y agoI used some early versions of Excel and am completely shocked the legacy macros still work. Article if you want to do some Win32 programming in XLM. https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros-xlm/ https://outflank.nl/blog/2018/10/06/old-school-evil-excel-4-...
- raxxorrax 6y ago> VBA is ancient — its still supported?! VBA is well supported actually. The community is completely insular and they sometimes complain that they are second to C#, but there is support for the newest .net runtime. Kudos to Microsoft on this one (or not, depending on your opinion). The language changed a lot of course.
- lawrencegs 6y agoDoes Office.com supports Macro? Seems like it does, but wouldnt it be immune to these attack?
- guessbest 6y agoThe web version doesn't support macros.
- Rebelgecko 6y agoI'm a little bit nervously skeptical of a security website that gives me a browser prompt about accessing Virtual Reality devices
- ChrisRR 6y agoOpens website Gets instant popup covering the content asking me to sign up Closes website
- kozhevnikov 6y agoIf you are using uBlock Origin or similar you can enable 'Annoyances' filter lists (off by default) that take care of many overlays, cookie popups, etc.
- pc86 6y agoEven better, you can just leave websites that do this. I have no interest in helping anyone beef up their numbers by hanging around longer if they're going to be outright hostile to their readers/users like this.
- aabbcc1241 6y agoMy browser doesn't run javascript by default, and the website is not an webapp, so it appear to be fine
- halfFact 6y agoWould you run a web app? Checking my strategy to avoid Apple's app store.
- stan_rogers 6y agoThe meaning there was that the web page is a web page with content pre-installed and everything, as opposed to an enormous but content-free javascript container that then does a lot of unnecessary work on your machine to fetch the content, piece by piece, and assemble and render the content that should have been assembled at the server before sending it to you.
- cdolan 6y agoFor real though, does ANYONE instantly sign up on the first visit to a website? Why does anyone continue to think this is a good idea? I immediately closed the article as well.