Malte Timmermann's Blog

You may have seen some news about an other virus for StarOffice and OpenOffice.org.
Symantec has reported it as SB.Starbugs.

I wasn't able to get the sample from Symantec, because such things are only given to AV vendors.

But Peter Ferrie from Symantec confirmed that "SB.Starbugs doesn't bypass OOo security checks and OOo will ask the user if to enable macros for that document. There are no exploits, no security concerns."

So SB.Starbugs does have some replication code, which might classify the macro as a virus, but OOo will not execute it without asking the user.

Again, it's just a macro, see “Some words about 'Macro Security' in office applications”

StarOffice and OpenOffice.org have a macro engine for good reasons.

You can create very useful solutions based on an office suite, or you can easily automate some tasks.
With macros, you can do almost the same things like with a stand alone native or Java application.

Macros have full access to system resources!

If a user runs a macro, he should be aware that it's the same like running any (downloaded) program.

When loading a document, StarOffice and OpenOffice.org check if there are macros included.

The user can choose between different security levels for macro execution in "Tools / Options / Security / Macro Security":

Low (not recommended): Macros are executed without confirmation request.
Medium (default): Confirmation required when executing macros from untrusted sources.
High: Only signed macros from trusted sources are allowed to run.
Very high: Only macros from trusted file locations are allowed to run.

Trusted sources means that the macros are signed by certain people or that the documents are stored in certain locations.

To completely disable document macros, simply set security level to "Very high" and don't configure any trusted source.

My recommendation: Never run any macros if you are unsure whether it's safe.
Same like how you would treat downloaded program files, I hope...

Currently there are a lot of news about "The first macro virus for StarOffice and OpenOffice.org".

I got the "proof of concept virus" from some antivirus company and looked a little bit deeper into that.

It's a macro in a sxw file, I can't find anything interesting there.
I asked the AV company if that is the "original", they confirmed it.
So I wonder why some news state, that it works in StarOffice 5.2, that file even can't be loaded there...

When the file is loaded, the user is asked if to enable macros from this document.
Even if the user choose "yes", there is no auto-start of any macro.

When the user manually starts the macro, the only thing that happens is that an image should be loaded into a new document, and some text is written in the current document.
That's all!

There is some sub routine called "InstallGlobalModule".
It's commented out, but even if you try to activate it, it doesn't work.

OpenOffice.org has a macro language with access to local resources.
Of course this macro language can be used for performing any kind of tasks, that's the intention of it!

Users shouldn't run macros from unknown sources, same like they shouldn't run any programs or other scripts from unknown sources.

There was the time when all the discussions about OASIS OpenDocument Format and Accessibility arised.
I again considered start blogging that time, because I am responsible for StarOffice Accessibility, but I didn't...

Now that all the news about a proof-of-concept virus for OpenOffice.org arise, I feel that I really should start now, because I am also responsible for StarOffice Security.

I don't like to read long blog entries myself, so I promise I will try to keep my blog entries short... ;)



Malte Timmermann's Blog Malte about some of his work at Sun Microsystems, Inc.