GCN Tech Blog

By GCN Staff

Blog archive

Microsoft Excel attack in the offing

Microsoft today confirmed a new hole in its widely used Excel spreadsheet program.

Security firm Secunia has reportedly been able to pinpoint the flaw on an updated Windows XP Service Pack 2 system with Microsoft Excel 2003 SP2. According to the firm, "This vulnerability is a so-called zero-day and is already being actively exploited....Don't open untrusted Excel documents."

Windows 95, Windows 98, Windows Me, Windows NT and Windows 2000 machines running Excel may also be at risk.

In Microsoft's Security Response Center blog, Microsoft Operations Manager Mike Reavey wrote, "In order for this attack to be carried out, a user must first open a malicious Excel document that is sent as an email attachment or otherwise provided to them by an attacker."

Symantec Corp. was reportedly first on the scene to spot the attack. In it, a Trojan horse called Trojan.Mdropper.j is transmitted in an Excel e-mail attachment with a name like "okN.xls."

eWeek describes the subsequent attack this way:

"When the Trojan is executed, it exploits the Excel flaw to drop and execute a second piece of malware called Downloader.Booli.A. It then silently closes Microsoft Excel, much like that way the Microsoft Word attack worked.

Downloader.Booli.A attempts to run Internet Explorer and inject its code into the browser to bypass firewalls. It then connects to a remote Web site hosted in Hong Kong to download another unknown file."


Major security companies have already added signatures to detect the attack, but users should beware.

Posted by Brad Grimes

Posted by Brad Grimes, Joab Jackson on Jun 16, 2006 at 9:39 AM


Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.