Word invented Stirlitz? Information for consideration
So, the sad story that my friend admin told me.
Please note that this is not a copy-paste, but a story I received (manuscriptum) from the first hand.
- There was a design office. And she was engaged ... you will be surprised ... design. Used for this AutoCAD. Who sailed - he knows what it is and what it eats. The program is a beast! But for a penny, she does not suck.
And then the project office workers would have designed, if not one annoying fact - the program on their computer (or rather, on 20 computers, but these are nuances), so the program was completely stolen from them. Installed from the blank bought on the Hump (and only the grave will fix the hunchback) for as much as 500 rubles.
Dokulachil good autocrat good for many thousand green rubles (for each copy).
And everything would be fine, the heroes would continue to work in the name and for the benefit of their loved ones, if one of their contractors had not looked, and maybe the contractors of their contractors were sent to the AutoCAD file.
And in the continuous mash-up of meta-data and tags stored in the document, the singled ID of the program was annoyingly dropped.
Further, as in a bad action movie, people in masks, with machine guns, all snout at the floor, but “Die Hard” did not come to the aid of people lying in the office ... And all because they shared it and were tied up by law.
- Many times the topic of unlicensed software has been raised. Many times innocent users of Open Source bite their elbows in ignorance, "How will they prove that their software is licensed?". But it’s not for those who are hearty to think stern thoughts. And those comrades who send doc, ppt, xls, psd files to the right and left without even thinking about how much interesting things can be extracted from ordinary-looking files.
What will our files tell?
Take for example MS Office. Generally speaking, the office format itself is described in sufficient detail. Here you can see a detailed description of the Word format:
pipin.tmd.ns.ac.yu/extra/fileformat/text/doc/wword8.html
')
Among the set of binary fields, FIB blocks of 512 bytes per page are allocated + as many on the so-called zero page. Given that most of the block is described, there are undocumented areas that can theoretically contain any information. For example, a program instance identifier (while the program version is recorded completely open). Is some hidden information inside the file evidence in court? Hardly. But it can easily become the basis for effective verification of the company's equipment, as a result of which violations are likely to be found, which will already become a 100% argument in court.
But are the dangers exhausted only by the undocumented bytes of our files? By no means. The fact that confidential information gets into an ordinary Word document is no longer a secret. Even deleted during editing data is stored in the document metadata stream and can be restored later.
One of the victims of the leak of metadata was for example, British Prime Minister Tony Blair. In his Word-documents concerning the invasion of Iraq, hidden (remote) information was found, which differs from the official position of the government of the country. Another example: metadata was discovered in the SCO Group documents, indicating that this company was about to file a lawsuit against Bank of America. The discovery of this data has mixed all the cards to the main opponent of Linux. You could even say that MS Office, without knowing it, helped Linux in the fight against baseless SCO lawsuits :)
At the end of my article I placed links to some materials on a given topic.
Created even a resource dedicated to the problems of hidden metadata.
www.metadatarisk.org
Let me summarize a few tips for your safety:
1. If you are using MS Office, use tools to detect hidden metadata, for example, Hidden File Detector, which can be found here www.wordsite.com/downloads/hfd.htm
2. In principle, do not allow undesirable statements in the early version of the document, even if you plan to delete them later.
3. Avoid sending or uploading proprietary proprietary formats to your site that may indicate that you are using expensive software packages (psd, cdr, and others). This may be the reason for the target check. Always give preference to an open alternative (in the case of a word, this could be an RTF file)
And remember, first someone knocks on you competent authorities and only then organs knock on your door with a check. Do not let your documents spy on your computer.
Good luck!
References:
wordexpert.ru/2007/01/04/kak-obnaruzhit-skryityie-dannyie-v-dokumente-word
www.cnews.ru/news/top/index.shtml?2005/01/31/173732
www.oszone.ru/4393
prezentation.ru/articles/metasecyriti_15_06_06_print.html
Please note that this is not a copy-paste, but a story I received (manuscriptum) from the first hand.
- There was a design office. And she was engaged ... you will be surprised ... design. Used for this AutoCAD. Who sailed - he knows what it is and what it eats. The program is a beast! But for a penny, she does not suck.
And then the project office workers would have designed, if not one annoying fact - the program on their computer (or rather, on 20 computers, but these are nuances), so the program was completely stolen from them. Installed from the blank bought on the Hump (and only the grave will fix the hunchback) for as much as 500 rubles.
Dokulachil good autocrat good for many thousand green rubles (for each copy).
And everything would be fine, the heroes would continue to work in the name and for the benefit of their loved ones, if one of their contractors had not looked, and maybe the contractors of their contractors were sent to the AutoCAD file.
And in the continuous mash-up of meta-data and tags stored in the document, the singled ID of the program was annoyingly dropped.
Further, as in a bad action movie, people in masks, with machine guns, all snout at the floor, but “Die Hard” did not come to the aid of people lying in the office ... And all because they shared it and were tied up by law.
- Many times the topic of unlicensed software has been raised. Many times innocent users of Open Source bite their elbows in ignorance, "How will they prove that their software is licensed?". But it’s not for those who are hearty to think stern thoughts. And those comrades who send doc, ppt, xls, psd files to the right and left without even thinking about how much interesting things can be extracted from ordinary-looking files.
What will our files tell?
Take for example MS Office. Generally speaking, the office format itself is described in sufficient detail. Here you can see a detailed description of the Word format:
pipin.tmd.ns.ac.yu/extra/fileformat/text/doc/wword8.html
')
Among the set of binary fields, FIB blocks of 512 bytes per page are allocated + as many on the so-called zero page. Given that most of the block is described, there are undocumented areas that can theoretically contain any information. For example, a program instance identifier (while the program version is recorded completely open). Is some hidden information inside the file evidence in court? Hardly. But it can easily become the basis for effective verification of the company's equipment, as a result of which violations are likely to be found, which will already become a 100% argument in court.
But are the dangers exhausted only by the undocumented bytes of our files? By no means. The fact that confidential information gets into an ordinary Word document is no longer a secret. Even deleted during editing data is stored in the document metadata stream and can be restored later.
One of the victims of the leak of metadata was for example, British Prime Minister Tony Blair. In his Word-documents concerning the invasion of Iraq, hidden (remote) information was found, which differs from the official position of the government of the country. Another example: metadata was discovered in the SCO Group documents, indicating that this company was about to file a lawsuit against Bank of America. The discovery of this data has mixed all the cards to the main opponent of Linux. You could even say that MS Office, without knowing it, helped Linux in the fight against baseless SCO lawsuits :)
At the end of my article I placed links to some materials on a given topic.
Created even a resource dedicated to the problems of hidden metadata.
www.metadatarisk.org
Let me summarize a few tips for your safety:
1. If you are using MS Office, use tools to detect hidden metadata, for example, Hidden File Detector, which can be found here www.wordsite.com/downloads/hfd.htm
2. In principle, do not allow undesirable statements in the early version of the document, even if you plan to delete them later.
3. Avoid sending or uploading proprietary proprietary formats to your site that may indicate that you are using expensive software packages (psd, cdr, and others). This may be the reason for the target check. Always give preference to an open alternative (in the case of a word, this could be an RTF file)
And remember, first someone knocks on you competent authorities and only then organs knock on your door with a check. Do not let your documents spy on your computer.
Good luck!
References:
wordexpert.ru/2007/01/04/kak-obnaruzhit-skryityie-dannyie-v-dokumente-word
www.cnews.ru/news/top/index.shtml?2005/01/31/173732
www.oszone.ru/4393
prezentation.ru/articles/metasecyriti_15_06_06_print.html
Source: https://habr.com/ru/post/17800/
All Articles