Microsoft Word Exploit in the Wild

Just another day in the Office.

Here is an update to the Microsoft Word Remote Code Execution vulnerability announcement from just a few days ago. Another zero-day vulnerability has been found along with exploits in the wild:

…this attack used a new zero-day vulnerability in Microsoft Word. It is reported that the emails originated from a Yahoo! email account, which the hacker accessed through a mobile device CDMA link to conceal their identity. Security professionals claim the emails contain information about the political situation in Iran and attempts to entice recipients…

[…]

Experts claim the attack was designed to steal sensitive data through the recipient’s computer.

Moreover, Microsoft continues to investigate another proof-of-concept zero day flaw for Word discovered last week. However, neither of the vulnerabilities are expected to be tackled in tomorrow’s security update, Patch Tuesday.

It’s not clear what separates the two vulnerabilities, or if they are just variations of the same flaw.

I suppose the Microsoft advice is still to never open word attachments unless you can verify the sender’s identity and confirm their good intentions. Easy to do in an Office environment, right?

The December 12th security updates do not seem to mention either vulnerability, although they do show a re-release of MS06-059, which fixes a fix for an Excel remote code execution vulnerability.

Some Microsoft Excel 2002 users who have Microsoft Windows Installer 2.0 installed received indication that the original version of security update 923089 for Excel 2002 was installed successfully. However, the actual binary file, Excel.exe, was not updated to the secure version. The re-release version of security update 923089 for Excel 2002 corrects this issue.

Verifying the success of a patch should never be underestimated.

Sudan IV dye pollution causes rise in food prices

It sounds like the process to detect a carcinogenic red dye called Sudan IV is non-trivial. Something to do with HPLC?

I mention this because in 2005 there was a Sudan dye scare in the UK, which apparently led directly to higher food prices:

Two recent incidents of turmeric contamination and 97 cases of sudan-contaminated palm oil for sale on the European food market prompted the Commission to call for tighter controls for both these foodstuffs.

Once details of the measures are cleared, the tighter rules mean that imports of both these foodstuffs must be accompanied by certificates to prove they are free of the carcinogenic sudan red food dye. Such certificates are currently required for all imports of chilli and chilli powder products into Europe.

[…]

Over 600 well known processed foods were pulled from the supermarket shelves after the UK’s Food Standards Agency (FSA) detected the illegal dye in a batch of worcester sauce made by St.Albans-based Premier Foods.

I suppose the recent incident in China should have the same effect, although it is not clear yet whether the Chinese are going to require red eggs to be more tightly controlled or just find someone to severely punish.

And while food prices might rise, I certainly would rather pay for food I can trust rather than some colorful piece of chemically altered substance that is approved for consumption by an agency that does not want to address the root of the problem (pun intended). In other words, my heartfelt congratulations to the Mayor of New York for the successful and complete ban of transfats even though the FDA seemed unable or unwilling to do so.

I understand the concern with a rise in food prices but sometimes I think people forget that the ban/control is for a known toxic substance that is almost undetectable to humans (i.e. tastes good). I’m happy to pay experts to ensure a better quality of life and prevent poison from entering my food, thank you.

The Brown Jug Law — Confiscating Fake IDs for Cash

Several years ago a para-legal, who also happened to be vice-president of the Brown Jug liquor store in Anchorage, initiated a new Fake ID law for Alaska. He promoted the notion that the market for fake IDs could be better regulated, based on the following logic:

When a minor uses a false identification or misuses a valid ID to attempt to circumvent the law, a crime has been committed, and that’s the case in almost every jurisdiction.

But too often the business that has been hoodwinked gets charged with the crime when it is in reality the business that is the victim.

In Alaska, they take a different tack: a business that is the victim or attempted victim of such fraud can confiscate the ID, then sue the perpetrator for $1,000 in civil damages.

After the law passed the Brown Jug started to alert parents of teens caught with fake IDs that they had the option of fighting a civil action or paying a $300 fine and sending the accused to alcohol awareness classes. Seems to me that someone using a fake ID to get alcohol is already plenty aware of the stuff, but I digress.

Has this approach been successful?

According to [Brown Jug’s] O’Neill, bouncers at the club spot a lot of false IDs and earn enough in resulting bonuses that these jobs have become very sought after and are considered to be high paying.

At Chilkoot Charlies, O’Neill said, one-third of the $1,000 penalty goes to the bouncer, one-third is kept by the company for administration (they pay a lawyer to process the letters and claims) and one-third is donated to a charity called People First.

As of the end of November, Brown Jug stores had confiscated almost 200 misused IDs. Last year the company nabbed 284, so word might be out that you do not attempt to use a phoney ID at Brown Jug—just the result the company was hoping for. “Kids spread the word,” O’Neill said.

“We confiscate more false IDs than all the other licensees in the state combined,” O’Neill said, not by way of bragging, but to illustrate how much more effective the law could be with more diligence from fellow licensees.

That last note caught my attention, especially as earlier in the article O’Neill admits

“Not enough licensees do it,” he said, “and no one at the police department has the time or desire to do it.”

Why not increase the fees until the police think it is worth their time or they have “desire”? Setting a bounty for accusations has its risks (aside from opportunity cost — police investigating other more serious offenses). For example, I wonder if they have run into a situation yet where unscrupulous bouncers or checkout clerks are generating the fake IDs themselves and then framing kids in order to blackmail parents? Taking that thought a little further, I wonder if Alaska will soon promote legislation that allows the people to sue companies responsible for security breaches involving IDs? That might help prevent fake IDs from reaching the market and thus be a powerful counterpart to the Brown Jug Law (incentive to detect fake IDs). Or, in a more specific sense, it would help decrease the incentive to steal an ID from one customer to blackmail another.

I found the Brown Jug Law article on the Montana Gaming Group website.

Rabbi ben Ezra

The Wikipedia has a nice entry on this famous Robert Browning poem:

It is not a biography of Abraham ibn Ezra; like all of Browning’s historical poems, it is a free interpretation of the idea that Ezra’s life and work suggests to Browning, but the poem is Robert Browning using Ezra as a mouthpiece, not the other way around. At the center of the poem is a theistic paradox, that good might lie in the inevitability of its absence:

    For thence,—a paradox
    Which comforts while it mocks,—
    Shall life succeed in that it seems to fail:
    What I aspired to be,
    And was not, comforts me:
    brute I might have been, but would not sink i’ the scale.

Reminds me of the saying that the best security is the stuff that is rarely or never seen.

Amazing how good Wikipedia can be sometimes.