Magicicaida"Web Bugs" in Microsoft Word

As noted on Freedom to Tinker, Microsoft Word contains a security flaw that allows "web bugs" to be included in documents. The fault lies with a Word feature called the INCLUDEPICTURE field, which references an image outside the document, either from a local file or a URL. A malicious person could secretly track who is reading a document by inserting a reference to an image from a server under his control. Every time Word loads the document, it will make a connection to the server to retrieve the image, revealing the local user's IP address and other information.

This vulnerability was initially discovered in 2000 by Richard M. Smith. It received some press coverage at the time, but the threat was downplayed because nobody was known to be exploiting it at the time. In the four years since then, Microsoft has released two new versions of Office but has yet to correct the problem . Meanwhile, at least one commercial service has sprung up to help users exploit the flaw for surreptitious tracking.

I have written a program (available below) to scan for these bugs in Word documents and remove them. Unfortunately, the vulnerability in Word can be extended to any application that supports OLE, including Excel and PowerPoint, by embedding the tracking bugs as Word OLE objects. Since each application uses a different format for writing OLE data to disk, it would be very difficult to write a general-purpose scanner.

Related files:


J. Alex Halderman
Created: May 26, 2004