Of MOICE and Microsoft: Securing Office 2003

May 11, 2007

Microsoft says it plans to release a tool called Microsoft Office Isolated Conversion Environment to help protect users of Office 2003 from exploits.

Microsoft officials say plans are on the way for a weapon that can help protect Office 2003 from attacks, though users of even older versions of Office may find themselves left out in the cold.

The company is developing a tool called MOICE (Microsoft Office Isolated Conversion Environment), which converts files from Office 2003 to the new Office 2007 Open XML format in a bid to strip exploits out of the file. Once a file has been cleansed of exploits, it can be opened as normal in Office 2003.

"One of the things we noticed is that when we converted an exploit document to the new Office 2007 'Metro' format, it would either fail the conversion [or] emit a nonexploitable file, or the converter itself would crash," Microsoft Senior Software Development Engineer David LeBlanc wrote in a recent blog post.

"Thus," he continued later in the post, "if we could pre-process documents coming from untrusted sources from the older format to the new format, and then get an older version of Office to use its converter to read in the new file format, the customer is going to end up safer."

Microsoft officials gave no specific date for when MOICE would be ready, but said the Redmond, Wash., company is working to make it available as soon as possible. The tool is specifically aimed at Office 2003. However, people using older versions such as Office 2000 or Office XP can use a compatibility pack that enables users to open, edit and save files in the Office 2007 format.

"The tool is a good thing for Office 2003 users from a security perspective, but it is a very kludgy approach," said John Pescatore, a Gartner analyst.

The problem, he said, is attackers will be able to see what the converter does and potentially come up with ways to bypass it.

"MOICE is not an end-all to the malicious [or] malformed Office .doc problem," Pescatore said. "But for enterprises that want to stay on Office 2003 for a few more years and have not invested in the desktop security products from folks like McAfee, Symantec and others that have behavior-based malware protections, MOICE will give a good increase in security."

Josh Edwards, technical product manager for Microsoft Office, said the conversions take place in an isolated sandbox environment so they can be done securely. The tool was designed with enterprises in mind, he said, explaining that attacks involving MS Office are typically targeted attacks and not simply sent to the everyday user.

The additional security comes with a potential drawback, though: It will take longer to open files, particularly large ones, Edwards said. Just how long can depend on many factors, such as whether or not the document includes graphics, he said.

"The user will notice," Edwards said. However, he said, "Is it something where you'll get up and get a coffee? No."

Copyright 2007 by Ziff Davis Media, Distributed by United Press International

Explore further: Software provides a clear overview in long documents

add to favorites email to friend print save as pdf

Related Stories

New field guide for Africa's mammalian Eden

Jun 10, 2014

From the kipunji – a secretive primate species first discovered by WCS in 2003 to the Indo-Pacific Humpback Dolphin, Tanzania is known for its staggering variety of large mammals including the largest diversity ...

Seniors bolster workforce at Berlin start-ups

May 28, 2014

Tech start-ups may often be littered with empty pizza boxes, but at a Berlin IT firm, a mouthwatering aroma wafting across the desks promises something truly revolutionary—a tasty and wholesome home-cooked ...

Recommended for you

Google searches hold key to future market crashes

10 hours ago

A team of researchers from Warwick Business School and Boston University have developed a method to automatically identify topics that people search for on Google before subsequent stock market falls.

Lenovo's smart glasses prototype has battery at neck

12 hours ago

China's PC giant Lenovo last week offered a peek at its Google Glass-competing smart glass prototype, further details of which are to be announced in October. Lenovo's glasses prototype is not an extreme ...

Amazon launches 3D printing store

15 hours ago

Amazon announced Monday the launch of an online store for 3D printed items to allow consumers to customize and personalize items like earrings, pendants, dolls and other objects.

User comments : 0