Microsoft Security Advisory (932553)

Microsoft is investigating new public reports of very limited Microsoft Excel "zero-day" attacks using a vulnerability in Microsoft Office 2000, Microsoft Office XP, Microsoft Office 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2004 v. X for Mac.

In order for this attack to be carried out, a user must first open a malicious Office file attached to an e-mail or otherwise provided to them by an attacker. While we are currently only aware of Excel as the current attack vector, all office documents are potential vectors.

As a best practice, users should always exercise extreme caution when opening unsolicited attachments from both known and unknown sources.

References:

• Microsoft Security Advisory 932553 – Vulnerability in Microsoft Office Could Allow Remote Code Execution
  

• MSRC Blog

Vista UAC Triggers

Ed Bott responded to a reader's question about UAC Account triggers with a quote from his recently published book, Windows Vista Inside Out. The question came from Ed's earlier post, which I had been planning on pointing out anyway. So, while you're at it, read the articles and the comments in both of Ed's articles, linked below. Great stuff, Ed!

UAC Triggers:

The types of actions that require elevation to administrator status (and therefore display a UAC elevation prompt) include those that make changes to system-wide settings or to files in %SystemRoot% or %ProgramFiles%. Among the actions that require elevation:

• Installing and uninstalling applications
• Installing device drivers
• Installing ActiveX controls
• Installing Windows Updates
• Changing settings for Windows Firewall
• Changing UAC settings
• Configuring Windows Update
• Adding or removing user accounts
• Changing a user’s account type
• Configuring Parental Controls
• Running Task Scheduler
• Restoring backed-up system files
• Viewing or changing another user’s folders and files

Within Windows Vista, you can identify in advance many actions that require elevation. A shield icon next to a button or link indicates that a UAC prompt will appear.

References:

• Why you need to be discriminating with those Vista tips

• What triggers User Account Control prompts?

Issue regarding Windows Vista Speech Recognition

Following is the first part of my post at the Windows Connected forum from last night on the Windows Vista Speech Recognition "issue":

As reported on the MSRC Blog,

"An issue has been identified publicly where an attacker could use the speech recognition capability of Windows Vista to cause the system to take undesired actions. While it is technically possible, there are some things that should be considered when trying to determine what the threat of exposure is to your Windows Vista system."

This is another of those situations where it is "technically possible", however there are a lot of variables that would need to be met in order for an attack to be successful. There are those who will look for absolutely any angle they can find to question the security of Windows Vista.

There have been numerous repeats across the Internet today about this "issue". What I find most disturbing is the manner in which various services are headlining it; i.e., "Talking security vulnerability in Vista", "Hackers can whisper sweet nothings into Vista's ear", "Vista has speech recognition hole", and more of a similar nature.

Let's break the MSRC post down a bit and read more carefully what it would take for such an attack to be successful:

• the targeted system would need to have the speech recognition feature previously activated and configured

• the system would need to have speakers and a microphone installed and turned on

• the exploit scenario would involve the speech recognition feature picking up commands through the microphone such as “copy”, “delete”, ”shutdown”, etc. and acting on them

• the commands would be coming from an audio file that is being played through the speakers

Even if all of the above was likely and the user was not there to turn off the microphone or speakers or shutdown the computer, note the sentences below, particularly the two in bold:

• It is not possible through the use of voice commands to get the system to perform privileged functions such as creating a user without being prompted by UAC for Administrator credentials.
  

• The UAC prompt cannot be manipulated by voice commands by default.
  

• There are also additional barriers that would make an attack difficult including speaker and microphone placement, microphone feedback, and the clarity of the dictation.

Know what I think? More sensationalism by the press and much ado about nothing.