Security risks of running Office 2003 post-EOS?

[pmv]

Clearly its a bad idea to use XP once support ends in April (for a machine on the net anyway). But as Office 2003 is also losing support, is that a security problem also?

I'm guessing that as long as the OS is secure and you have the usual anti-malware, Office is not such a major problem unless you are a corporation who have to be paranoid about such things for legal reasons? Or can it be a significant weakness if not updated?

Thanks.

 

[Charlie98]

Interesting question... I didn't realize they were nixing support for O'03... I'm still running Outlook '03.

 

[lxskllr]

Document types get exploited, and have security fixes. Here's an example...

https://krebsonsecurity.com/2011/05/security-fixes-for-microsoft-windows-office/

but there's plenty more you can find. I picked a random link from this search...

https://duckduckgo.com/?q=security+fixes+office

I wouldn't run an an out of date Office, but I might not be the best example since I wouldn't run Office in the first place :^D

 

[Virgorising]

Document types get exploited, and have security fixes. Here's an example...

https://krebsonsecurity.com/2011/05/security-fixes-for-microsoft-windows-office/

but there's plenty more you can find. I picked a random link from this search...

https://duckduckgo.com/?q=security+fixes+office

I wouldn't run an an out of date Office, but I might not be the best example since I wouldn't run Office in the first place :^D

I run Office 2007 on this W7 64-bit system and see not one reason to pay for Office 2010 or 2013. But, I would not run an unsupported version.

 

[Virgorising]

Interesting question... I didn't realize they were nixing support for O'03... I'm still running Outlook '03.

They ARE ending support for Office 2003 same time they are for XP,

 

[Mushkins]

Theres plenty of viruses that specifically target Outlook in order to harvest address books and send spam. I wouldnt run Office 2003 after end of support personally.

 

[Virgorising]

Theres plenty of viruses that specifically target Outlook in order to harvest address books and send spam. I wouldnt run Office 2003 after end of support personally.

:thumbsup:

 

[Charlie98]

Theres plenty of viruses that specifically target Outlook in order to harvest address books and send spam. I wouldnt run Office 2003 after end of support personally.

Welllll.... poop.

I'm running the rest of my Office stuff (Word/Excel/PP) as O'10... guess I'll have to upgrade.

 

[mechBgon]

I run Office 2007 on this W7 64-bit system and see not one reason to pay for Office 2010 or 2013. I would not run an unsupported version.

Office 2010 and 2013 have substantial security upgrades over 2007. The first examples coming to mind are Protected View, DEP, and File Validation. More insights yonder: https://www.cert.org/blogs/certcc/2011/04/office_shootout_microsoft_offi.html

On the original topic: yeah, just like it would be quite risky to use WinXP after support ends, ditto for Office. Once support expires, the bad guys can bust out their new exploits and get lots of results with them, since there's no patch coming to break up their party.

 

[Virgorising]

Welllll.... poop.

Thank you for making me smile.

 

[Virgorising]

Office 2010 and 2013 have substantial security upgrades over 2007. The first examples coming to mind are Protected View, DEP, and File Validation. More insights yonder: https://www.cert.org/blogs/certcc/20...soft_offi.html

Interesting!

But, given what I just read, I do not think I am in harm's way with 2007. Do I wish they would undo the the disgusting/stupid ribbon thingy altogether? YES.

But, it is wut it is, and not hard to not let it stop you from doing what previous versions let us do more logically. My take is, increasingly, there is no luminous, singular, inspired vision at MS. Too many hack cooks muddying the broth.

As for those whose lives are so empty as to even be moved to gestate/write insects to infest the computers of DECENT humans.......I would like to see ALL of them in orange jump suits as soon as possible.

But I guess it don really work the satisfying way it is portrayed on such as Law & Order. (Sigh.)

 

[mechBgon]

Interesting!

But, given what I just read, I do not think I am in harm's way with 2007.

I own a full Office 2007 myself, but based on my keeping up-to-date on the subject of security, I would be very reluctant to use it anymore. Office 2010 was a big leap forward in exploit mitigations.

As for those whose lives are so empty as to even be moved to gestate/write insects to infest the computers of DECENT humans.......I would like to see ALL of them in orange jump suits as soon as possible.

Understand the adversary. They're financially motivated professional software writers with a substantial working budget. If they can use an exploit on Word 2007 to get an advanced banking Trojan installed on the average home or small business user's system, they have a good chance of adding them to the long list of victims whose bank accounts have been emptied. This stuff isn't the work of amateurs just trying to cause trouble for its own sake.

Random example: http://www.krebsonsecurity.com/2013/11/feds-charge-calif-brothers-in-cyberheists/

That title firm was unaware of it at the time, but fraudsters had recently installed the ZeuS Trojan on an employee’s computer and were using it to send wire transfers and ACH payments to money mules and to bank accounts controlled by the bad guys.

On the bright side, for once the perps actually got arrested but that's too seldom. I try not to fall into "securinoia" but in light of the original topic here, I'll stick with at least Office 2010. If you want to keep using Office 2007, I would suggest getting the Office File Validation add-on, plus installing and configuring Microsoft EMET 4.0 to force DEP and ASLR on your Office programs despite themselves. Unsupported Office 2003 is <Monty Python> right out </MP>.

Another worthwhile step, especially since you recently found rootkits on your own system, is to download, install and run Secunia's Personal Software Inspector. It'll look for software that needs security updates, and help you locate the updates, so your system has less attack surface. If the scan shows old software that you know you don't use anymore, you can also uninstall it so it's not an exploit risk.

 

[Virgorising]

Understand the adversary. They're financially motivated professional software writers with a substantial working budget. If they can use an exploit on Word 2007 to get an advanced banking Trojan installed on the average home or small business user's system, they have a good chance of adding them to the long list of victims whose bank accounts have been emptied. This stuff isn't the work of amateurs just trying to cause trouble for its own sake. Random example: http://krebsonsecurity.com/2013/11/f...n-cyberheists/

OMG! MAY the cybergod bless U for this, cause I had NO CLUE!!! I am now taking this very seriously.

THANK YOU.

Question: is the insect you refer to so elusive and pernicious as to avoid discovery by good protection apps?????? Or formidable encryption by my bank? Error 404 - Page not found

Sorry, the page you are looking for has either been moved or removed from the website.


Pale Moon is giving me the above when I hit yr link. U think it is a TROJAN? Kidding. Cept, of late, I seem to be having new deluge of panaroia fostering data rain down.

 

[mechBgon]

It must be the 404 Trojan Well go to http://www.krebsonsecurity.com and go down to the Target: Small Business tag down the page on the right-hand side. Brian has quite a few such write-ups.

 

[Virgorising]

It must be the 404 Trojan

Thank you for extending follow up cuteness into creep you outness. The former leavens the latter.

I will now follow up.

I honestly did not know that some of the sociopathic lowlifes do what they do for a living!!!:|
____________________________________________
Edit! that link worked so the 404 trojan must have left on its own:sneaky:. Only other day, in some thread, can't remember which, maybe even this one.....I posted those data on target hacking and Neiman Marcus!

But re the Target debacle....and that truly defines debacle, EPIC LEVEL, I thought, heard....despite the numbers, the issues centered on shoppers in actual stores and not online. But given the numbers, that actually now makes no sense.
________________________________________________
New edit: and, DUH.....the Sino connection evil appears the most insidious.....more than the Russian connection evil.

 

[Virgorising]

One more little confusion, a new one: While I never really peruse the patches coming in on a given Hotfix Tuesday, I just want them to arrive and install and reboot and get it over with ASAP.....I am positive I have seen quite a number for Office 2007.

Are we certain MS is not on the little vulnerability case in this?

 

[Virgorising]

K.....see, I move fast cause I despise living in fear, and learning what I did just earlier, I had big fear. So, I uninstalled Office 2007, cleaned registry.....THEN, with uber RESENTMENT, went and got Office 2010 and installed it. Right this second, 8 bazillion patches are downloading from Windows update.

I opened the new the GUI, HATE IT.... and want my carefully configured old one to appear without having to make a single mouse click.

But at least my new, sudden OMG wut????? is gone. Well, will be when this disgusting thing (whose cost should have gone into piggy bank for down the road Optiplex 9020 MT, i7 4770 not k...still a thousand dollars even with the discount and no add ons/upgrades) ...... is fully patched. (Breathe())

THEN, I will do new clone from this drive to my backup drive which is still living in fool's paradise running Office 2007.

I am deeply grateful to have learned what I did via MechBgon:wub: even tho I hated it!!!!!
_________________________________
Edit: reboot finished after patches......I even hate the new Word icon now on my desktop instead of the old icon. It is ugly, the W is needlessly huge.

MS IS the company store....and, unless we choose to run open source.....the only one in town.

 

[Virgorising]

See this?? Wut is this, something for 6 year olds?? This is some IMPROVEMENT over Office 2007? How insulting is this??? What are they thinking out there???

 

[mechBgon]

See this?? Wut is this, something for 6 year olds?? This is some IMPROVEMENT over Office 2007? How insulting is this??? What are they thinking out there???

The text-styles panel... I'm guessing the reason it looks like that, is that people (with average eyesight, anyway) are fast at visually choosing the style they need, rather than having to rummage for it on a menu (although that option is right below, in the fly-out menus). I honestly don't remember what 2007's version looked like.

One of the neat-o new capabilities of 2010/2013 is that you can make potentially-hazardous types of files open in Protected View by default, so they're extra restricted in what they could try to do. For example, Rich Text Format (.RTF) has been making a comeback as an attack vector, so you could set your 2010 to open them in Protected View by default no matter where they came from. That setting is in File > Options > Trust Center > Trust Center Settings button > File Block.

By default, stuff that originated from the Internet should already open in Protected View by default, and so will Outlook email attachments in particular. You can further mandate that all files of, say, the .RTF filetype will ALWAYS open in Protected View.

On a tangential note, you can do similarly with Adobe Reader if you have it installed. Enable Protected View for all files like this:

Also disable its JavaScript by unchecking this box:

There's a couple other good tips here: http://security.thejoshmeister.com/2010/05/7-easy-steps-to-increase-adobe-reader.html

 

[Virgorising]

The text-styles panel... I'm guessing the reason it looks like that, is that people (with average eyesight, anyway) are fast at visually choosing the style they need, rather than having to rummage for it on a menu (although that option is right below, in the fly-out menus). I honestly don't remember what 2007's version looked like.

Well, when you mouse over the icon, the drop down menu says it lets one "apply a visual effect to the selected text, such as a shadow, glow or reflection" (And not a moment too soon!!!)

Now, what leaves me like this , is their apparent premise in choosing to put this icon right there in this version of WORD, had to be: a SIGNIFICANT PERCENTAGE of adult humans---perhaps the VAST MAJORITY--- would be so relieved and THRILLED, cause THIS, beyond all else, is the (at the fingertips) OPTION said humans have been lusting for since Office got born!:whiste:

My feeling is, at this very moment, they are out there writing code for an ANIMATED TEXT option for an upcoming build....and the (animated) icon for THAT... will be prominent in the ribbon of THAT build.:whiste:

(End of sardonic section.())

NOW....as for all the other goodies you took the time to delineate, forget with visuals, I, I'll bet, along with others here am knocked OUT. A veritable, definitive, detailed tutorial to augment safety in WORD forget, a link to more!!!:thumbsup::thumbsup: Amazing.

I will now save that and also PRINT IT OUT.

YOU.....should be a CRYPTOLOGIST!!!!()

Many thanks for these precious offerings!
________________________________________________
Edit: yes indeed: in my Trust center, the default was already set to Open Protected. I changed it to open protected allow editing. Not sure if that was safe, it felt as if I would retain the options I need by new default.

 

[nemesismk2]

I just don't understand how it has taken microsoft this long to fix Office 2003? I lost all faith in microsoft along time ago so everything with microsoft in the name or windows should never go online ever again lol

 

[pmv]

Drat!

Guess I'll have to give Open Office another try (didn't get on with it last time).

 

[mechBgon]

Drat!

Guess I'll have to give Open Office another try (didn't get on with it last time).

Last I checked, OpenOffice will saddle you with Java. Fortunately most of OpenOffice does not actually require Java to function, so I'd suggest just uninstalling Java immediately. As you probably know, Java's browser plug-in in particular has been a huge security liability.

 

[lxskllr]

Drat!

Guess I'll have to give Open Office another try (didn't get on with it last time).

If you go that route, I'd use LibreOffice. It's the "real" libre office suite choice at this time, and gets more developer attention.