3

Sometimes I have to download some word or excel documents from incredible sites. I need not only to read but also to edit them. I heard that Microsoft Office suite is a very popular attack vector. Although I patch my windows and office regularly I guess there must be many 0day vulnerabilities in them. In order to mitigate the risk, after downloading a word document, I would upload it to the Google Docs, make some small changes and download it with a different format (for example, if the original file is a *.doc file then I would download it as a *.docx file and vise versa). I guess such conversion may "sanitize" (or at least break) the malicious code (if any) in the suspicious file but I am not sure whether it does work.

So, does anyone know whether it works?

  • 1
    This is a good question. If you don't receive a satisfactory response here, move it over to security.stackexchange.com. Not to imply that it's off-topic here, but just that those people over there are very knowledgeable about this sort of thing. – n8te Oct 31 '16 at 7:58
  • Thanks @n8te! I just wondered whether it belongs to superuser but I did not know the security.stackexchange.com before. – Mamsds Oct 31 '16 at 8:38
  • No problem. I see you posted it over there now. I would go ahead and delete this one here now before someone over on that site brings up the fact that you're not supposed to cross post the same question at two different SE sites. Besides, I'm sure you'll get a much more thorough response to this type of question over there anyway. – n8te Oct 31 '16 at 8:46
0

Microsoft has a tool that does exactly this, MOICE, Microsoft Office Isolated Conversion Environment(2007 release not sure if this has been updated).

https://docs.microsoft.com/en-us/security-updates/securityadvisories/2007/937696

What you are trying to achieve with Google Docs will work as well. Essentially, exploits that are targeting the victim are written for a specific platform/parser and when you change the format, the exploit will not work. Can someone build an exploit that may survive that format change? Why not, but I haven't heard anyone achieve that (although it has been demonstrated that multi-platform malware exist but very very rare).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.