When the user clicks the “Enable Editing” button, Word will assume that the user trusts the document and it proceeds to load all of the external resources required to display the document in the “normal” edit mode. For instance, the following screenshot illustrates what the document looks like if an external image is not fetched:
This often means that the document will look incomplete, because the user is only able to see a preview of the document without any of the content that is linked to a network location. When Word opens a document in Protected View, it renders a read-only view of the document using only data contained in the document itself – it does not attempt to load any resources not actually found in the file. In this blog post, I will demonstrate three different attacks that are stopped by Protected View. Microsoft Word, as an example, will open untrusted email attachments in a mode called “ Protected View“. Someone engaging in spear phishing could employ Word-based web trackers to learn more about the type of desktop computer and operating system a target is using, helping the spear phisher tune his or her strategy for further attack. To reduce the risk of this exposure, Microsoft Office applications like Outlook, Word and Excel use a trust model to determine how to handle documents that are downloaded from the internet or which arrive via email.
Unfortunately, these features can be abused by bad actors to obtain operational intelligence on individuals, or even to steal credentials. This is a great feature within corporate environments because it facilitates the reuse of assets like logos and corporate document templates.
Microsoft Word has long offered support for loading images and templates over the network.
0 kommentar(er)
