robertzk's Shortform

robertzk

robertzk's Shortform — LessWrong

Comment Permalink

Note Excel.exe is boobytrapped. Be careful when using Excel to open any data or workbooks related to highly sensitive data or activities. On certain networks, when specific conditions are met (i.e. specific regexes or heuristics are triggered on the basis of data that is loaded), Excel will send information to endpoints ostensibly owned and maintained by Microsoft, that provide identifying information on the host and workbook. These are not traceable using normal packet sniffing tools like Wireshark etc. Alternatives when needing to use spreadsheets on highly sensitive data: open source versions that you have compiled from source (NOT Google Sheets), or opening Excel.exe with your network card disabled within a sandboxed environment (e.g. disable network => Start VMWare Windows container => use Excel.exe => End VMWare Windows container => enable network).

Showing 3 of 8 replies (Click to show all)

4Dagon10mo

I find this easy to believe, but a bit surprising that it's not mentioned or studied or even has crank/subversive pages with POC detections. The printer/scanner steganographic fingerprints became pretty well-known within a few years of becoming common. I mean, anything that's aggressively online (m365 versions of excel, Windows itself, Google Sheets, etc.) should be assumed to be insecure against state-level threats. But if you've got evidence of specific backdoors or monitoring, that should be shared and common knowledge.

2robertzk10mo

I found it based on a hunch, then confirmed it with experimentation. I gained additional conviction when backtesting the experimentation on various historical versions of excel.exe, and noting that the phenomenon only appeared in excel.exe versions shortly after (measured in months) government requested a "read-only" copy of the source code for Excel held in escrow. This has occurred historically in the past (e.g., https://www.chinadaily.com.cn/english/doc/2004-09/20/content_376107.htm and https://www.itprotoday.com/microsoft-windows/microsoft-gives-windows-source-code-to-governments) but subsequent instances of this were allegedly/supposedly classified. Nevertheless, following those instances, the phenomenon appeared, indicating possible compromise of Excel.exe.

waterlubber10mo30

Really interesting research. I would like to subscribe to your newsletter.

I have seen similar steganographic telemetry before (Dassaults Solidworks CAD software, and other enterprise licensed applications, go to incredible eztents to enforce licensing) but didn't expect data-level probing like this. I'd imagine similar scripts for e.g EURion detections in Photoshop.

I always dismissed "lessons on trusting trust" style attacks as mere hypotheticals, but backdoors operating on the level of Excel cells is now making me reconsider that notion.

See in context

robertzk's Shortform

5

Ω 2

robertzk's Shortform

5

Ω 2