Recently, a research paper was published highlighting problems with the encryption used in Microsoft Office (specifically Word and Excel). Microsoft Office, which accounts for 95% of the market for productivity programs, uses the encryption mechanism known as RC4. Hongjun Wu, the researcher who discovered the problem, suggested that there was a potentially serious flaw in the way the encryption is implemented.
Wu concluded that "The initialization vector remains the same when an encrypted document gets modified and saved. The consequence is that the same keystream is used to encrypt the different versions of a document and a lot of information could be retrieved from those encrypted files. If anyone has used the encryption in the Microsoft Office in the way similar to that described in this report, then it is time for him/her to assess the damage that has been caused."
Not happy with the response from Microsoft, today Phil Zimmermann, the creator of PGP Encryption, talked to Techworld.com and expressed his concern about the weakness. Zimmermann said that he thought it was a seriously problem, and described it as "highly exploitable. It is not a theoretical attack." Security expert Bruce Schneier (Neowin Interview) further described the flaw as an "amateur crypto mistake", and noted that a virtually identical issue emerged almost 5 years ago with Windows NT.
We too were concerned at the apparent lack of progress on the issue; Neowin contacted Microsoft about the problem and asked what was going on. Microsoft said that they were unaware of any attacks exploiting the vulnerability, and that there was thus currently no customer impact based on the fact. A spokesperson told us that their "investigation indicates that this issue poses a very low threat for customers. In some cases, an attacker may be able to read the contents of an encrypted file if multiple versions of that file are available to the attacker. The attacker would need to have access to two distinct files with the same name that are protected by the same password in order to attempt to exploit the vulnerability." The company advises customers to restrict access to their information and to use a different password each time a document is saved with changes.
Microsoft expressed concern at the way in which the flaw was disclosed, and urged people who do find problems with their products to follow the standard industry practise of reporting the problem to the company directly, and reduce the potential risk to their customers. At this time, Microsoft were unsure as to whether a patch to address the issue would be issued or not; a spokesperson said that once their review of the flaw was complete they would decide whether or not to issue a patch in via their monthly release progress. Neowin readers looking for alternative software encryption tools in the meanwhile can find information here.
View: "The Misuse of RC4 in Microsoft Word and Excel" (pdf)
-1 Comments - Add comment