Of MOICE and Microsoft: Securing Office 2003

May 11, 2007

Microsoft says it plans to release a tool called Microsoft Office Isolated Conversion Environment to help protect users of Office 2003 from exploits.

Microsoft officials say plans are on the way for a weapon that can help protect Office 2003 from attacks, though users of even older versions of Office may find themselves left out in the cold.

The company is developing a tool called MOICE (Microsoft Office Isolated Conversion Environment), which converts files from Office 2003 to the new Office 2007 Open XML format in a bid to strip exploits out of the file. Once a file has been cleansed of exploits, it can be opened as normal in Office 2003.

"One of the things we noticed is that when we converted an exploit document to the new Office 2007 'Metro' format, it would either fail the conversion [or] emit a nonexploitable file, or the converter itself would crash," Microsoft Senior Software Development Engineer David LeBlanc wrote in a recent blog post.

"Thus," he continued later in the post, "if we could pre-process documents coming from untrusted sources from the older format to the new format, and then get an older version of Office to use its converter to read in the new file format, the customer is going to end up safer."

Microsoft officials gave no specific date for when MOICE would be ready, but said the Redmond, Wash., company is working to make it available as soon as possible. The tool is specifically aimed at Office 2003. However, people using older versions such as Office 2000 or Office XP can use a compatibility pack that enables users to open, edit and save files in the Office 2007 format.

"The tool is a good thing for Office 2003 users from a security perspective, but it is a very kludgy approach," said John Pescatore, a Gartner analyst.

The problem, he said, is attackers will be able to see what the converter does and potentially come up with ways to bypass it.

"MOICE is not an end-all to the malicious [or] malformed Office .doc problem," Pescatore said. "But for enterprises that want to stay on Office 2003 for a few more years and have not invested in the desktop security products from folks like McAfee, Symantec and others that have behavior-based malware protections, MOICE will give a good increase in security."

Josh Edwards, technical product manager for Microsoft Office, said the conversions take place in an isolated sandbox environment so they can be done securely. The tool was designed with enterprises in mind, he said, explaining that attacks involving MS Office are typically targeted attacks and not simply sent to the everyday user.

The additional security comes with a potential drawback, though: It will take longer to open files, particularly large ones, Edwards said. Just how long can depend on many factors, such as whether or not the document includes graphics, he said.

"The user will notice," Edwards said. However, he said, "Is it something where you'll get up and get a coffee? No."

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: IBM unveils cognitive exploration to drive better business outcomes

add to favorites email to friend print save as pdf

Related Stories

Coming up for air

Oct 29, 2014

Sometimes you've got to hit bottom to battle your way back up. In 1992, the United Nations cited Mexico City as having the worst air quality in the world, with so much pollution that birds sometimes dropped ...

Philippines 'breaks world tree-planting record'

Sep 28, 2014

Philippine officials said Saturday they had set a new world record for the most trees planted in an hour, with 3.2 million seedlings sown as part of a national forestation programme.

Drones left out of air traffic plans

Sep 24, 2014

Designers of the ambitious U.S. air traffic control system of the future neglected to take drones into account, raising questions about whether it can handle the escalating demand for the unmanned aircraft ...

Apple a decade behind Japan mobile payment curve

Sep 14, 2014

Apple's proud announcement that its new iPhone could be used to buy goods in a single swipe left customers non-plussed in Japan, where mobile contactless payments have been normal fare for a decade.

Recommended for you

Smarter, quicker-thinking referees? There's an app for that

Oct 27, 2014

KU Leuven and UEFA, European football's governing body, have embarked on a four-year project to expand and fine-tune a web-based skills training platform for referees. Early results show that the application can improve assistant ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.