<<< Date Index >>>     <<< Thread Index >>>

Re: Microsoft Word Protection Bypass



In-Reply-To: 
<OF60A8C9AA.4F52F3E5-ON00256E0F.003B08BA-C1256E0F.003B9AEC@localhost>

>To: bugtraq@xxxxxxxxxxxxxxxxx
>Cc: "Microsoft Security Response Center" <secure@xxxxxxxxxxxxx>
>Subject: Microsoft Word Protection Bypass
>From: Thorsten Delbrouck-Konetzko <Thorsten.Delbrouck@xxxxxxxxxxxxxx>
>Date: Fri, 2 Jan 2004 10:51:03 +0000
>Content-Type: multipart/mixed; boundary="=_mixed 003B9AC4C1256E0F_="
>
>Microsoft Word provides an option to protect "forms" by password. This is 
>used to ensure that unauthorized users cannot manipulate the contents of 
>documents except within specially designed "form" areas. This feature is 
>also often used to protect documents which do not even have form areas 
>(quotations/offers etc.).
>
>This form protection can easily be removed without any additional tools 
>(apart from a hex-editor).
>
>Please find the full advisory attached.

Actually, we have reported about this problem almost three years ago at "Black 
Hat Windows Security 2001" conference (Las Vegas, Feb'2001), see:

http://www.blackhat.com/html/bh-multi-media-archives.html#Windows%20Security%202001

Here is the presentation ("Analysis of Microsoft Office Password Protection 
System, and Survey of Encryption Holes In Other MS Windows Applications") in 
PowerPoint format:

http://www.blackhat.com/presentations/win-usa-01/Malyshev/bh-win-01-malyshev.ppt

And streaming video:
rtsp://media-1.datamerica.com/blackhat/bh-usa-win-01/video/bh-usa-win-01-andrey-malyshev-video.rm

Microsoft, of course, was aware. There is an article published in Microsoft 
TechNet:

Ask Us About... Security, March 2001
http://www.microsoft.com/technet/columns/security/askus/auas0301.asp

Quote from there:

"Recovering Office passwords
Q: I'm creating a document using Microsoft Word that may potentially contain 
sensitive information. I note that Word has a password protection feature 
(under Tools/Protect Document). How strong is the security surrounding this 
feature? 
A: I get a lot of mail asking about the strength of passwords for Office 
documents. As was demonstrated in an analysis of the Microsoft Office password 
protection system presented by ElcomSoft at Black Hat (see above), the 
password-protection features of these programs were not designed to be 
invincible. [...]"

You may also want to have a look at our software that can recover or remove 
this password, among many other ones:

Advanced Office XP Password Recovery
http://www.elcomsoft.com/aoxppr.html

-- 
Sincerely yours,
  Vladimir

Vladimir Katalov
Managing Director
ElcomSoft Co.Ltd.
Member of Association of Shareware Professionals (ASP)
Member of Russian Cryptology Association
mailto:vkatalov@xxxxxxxxxxxxx
http://www.elcomsoft.com