EASTLondon
01-20-2005, 03:53 PM
Published: January 20, 2005, 12:39 PM PST
By Robert Lemos
Staff Writer, CNET News.com
The data protection feature in Microsoft Word and Excel documents has a major flaw that could allow snoopers to decode password-protected files, a security researcher has warned.
The problem arises because Microsoft programmers did not implement the encryption correctly in its Office applications, Hongjun Wu, a cryptographer at the Institute of Infocomm Research in Singapore, wrote in a paper on the topic (http://dw.com.com/redir?destUrl=http%3A%2F%2Feprint.iacr.o rg%2F2005%2F007&siteId=3&oId=2100-1002-5543940&ontId=1009&lop=nl.ex).
"A lot of information could be retrieved from those encrypted files," Wu said in the paper. "If anyone has used the encryption in Microsoft Office...then it is time for him/her to assess the damage that has been caused."
Microsoft said Thursday that it has begun investigating the flaw.
"Our early investigation indicates that this issue poses a very low threat for customers," Microsoft said in a statement sent to CNET News.com. "In some cases, an attacker may be able to read the contents of an encrypted file, if multiple versions of that file are available to the attacker. The attacker would need to have access to two distinct files with the same name that are protected by the same password in order to attempt to exploit the vulnerability."
In the world of cryptographers, encryption schemes that encode more than one message using the same key are seen as flawed. That's because a comparison of the information in the encrypted messages can significantly shorten the search for the correct key to unlock the messages.
The Microsoft Office flaw is the latest issue that Microsoft has had with implementing encryption in its products. Security researchers have taken the company to task repeatedly in the past for the weak passwords (http://news.com.com/Cracking+Windows+passwords+in+seconds/2100-1009_3-5053063.html?tag=nl) in previous versions of the Windows operating system. Moreover, the company was at the center of a debate in 1999 (http://news.com.com/Expert+says+Windows+has+a+security+breac h/2100-1001_3-230621.html?tag=nl) on whether the code keys central to Windows NT security were actually secure.
The current issue is almost identical to the weak system key issue in 1999, said Bruce Schneier, chief technology officer of Counterpane Internet Security and author of "Applied Cryptography."
"This is a kindergarten crypto mistake," Schneier said. "And to make it twice is worse...."
News article link (http://news.com.com/Flaw+found+in+Office+encryption/2100-1002_3-5543940.html?tag=cd.top)
By Robert Lemos
Staff Writer, CNET News.com
The data protection feature in Microsoft Word and Excel documents has a major flaw that could allow snoopers to decode password-protected files, a security researcher has warned.
The problem arises because Microsoft programmers did not implement the encryption correctly in its Office applications, Hongjun Wu, a cryptographer at the Institute of Infocomm Research in Singapore, wrote in a paper on the topic (http://dw.com.com/redir?destUrl=http%3A%2F%2Feprint.iacr.o rg%2F2005%2F007&siteId=3&oId=2100-1002-5543940&ontId=1009&lop=nl.ex).
"A lot of information could be retrieved from those encrypted files," Wu said in the paper. "If anyone has used the encryption in Microsoft Office...then it is time for him/her to assess the damage that has been caused."
Microsoft said Thursday that it has begun investigating the flaw.
"Our early investigation indicates that this issue poses a very low threat for customers," Microsoft said in a statement sent to CNET News.com. "In some cases, an attacker may be able to read the contents of an encrypted file, if multiple versions of that file are available to the attacker. The attacker would need to have access to two distinct files with the same name that are protected by the same password in order to attempt to exploit the vulnerability."
In the world of cryptographers, encryption schemes that encode more than one message using the same key are seen as flawed. That's because a comparison of the information in the encrypted messages can significantly shorten the search for the correct key to unlock the messages.
The Microsoft Office flaw is the latest issue that Microsoft has had with implementing encryption in its products. Security researchers have taken the company to task repeatedly in the past for the weak passwords (http://news.com.com/Cracking+Windows+passwords+in+seconds/2100-1009_3-5053063.html?tag=nl) in previous versions of the Windows operating system. Moreover, the company was at the center of a debate in 1999 (http://news.com.com/Expert+says+Windows+has+a+security+breac h/2100-1001_3-230621.html?tag=nl) on whether the code keys central to Windows NT security were actually secure.
The current issue is almost identical to the weak system key issue in 1999, said Bruce Schneier, chief technology officer of Counterpane Internet Security and author of "Applied Cryptography."
"This is a kindergarten crypto mistake," Schneier said. "And to make it twice is worse...."
News article link (http://news.com.com/Flaw+found+in+Office+encryption/2100-1002_3-5543940.html?tag=cd.top)