Microsoft Office 2010 Professional Plus A (Microso

As I announced last week, I;m holding a brief but sweet Microsoft codename contest this week,Microsoft Office Professional Plus 2010, with all the prize becoming a free of charge signed copy of my Microsoft two.0 guide (which I will ship anyplace within the planet towards the winner).
Since I introduced the guidelines and rules, I;ve gotten more than a few fascinating submissions. I was looking for from visitors new (but real and current) Microsoft codenames which I;ve had but to detail as part of my growing Microsoft Codename listing. I'm operating a number of the ideal ones (as judged by yours genuinely) on my weblog this week.
Without additional ado, allow;s get to it.
Codename of the day: Wringer
Best guess on what it really is: MOICE - the Microsoft Workplace Isolated Conversion Environment
Meaning/context with the codename: The MOICE task isn;t new,Microsoft Office 2007 Pro Plus, however the codename and its origins had been new to me. MOICE is designed to “wring out” malicious content from Workplace documents.
Hold onto your hats for the full explanation from Software Security Engineer Robert Hensing;s blog:
“(B)asically what MOICE does is it hijacks the file associations inside the registry and redirects them to a process called ‘MOICE.EXE;. This process basically spawns the Workplace 2007 file format converter to up-convert the double-clicked Office 2003 document to the new Open XML file format. Oh and the converter runs in its own desktop with a super-locked down token (Dave is the freaking man!). Why run the converter in its own desktop with a super restricted token? Simple - what if the act of converting the file leads to an exploitable bug and / or code execution. This is effectively dropping the rights with the logged on user to *below* standard user levels in order to do the file conversion. Anyhoo - after the file is up-converted to the new Workplace 2007 file format - the theory is that the vulnerability will have been ‘wrung; out (indeed the code name for this project was ‘Wringer;).”
Back story: Office remains a big hacker target — something of which Microsoft is quite aware. As Hensing blogged:
“(I)t;s no secret that Office was utilized in some targetted attacks last year . . . some attacks involving 0-day vulnerabilities for which our customers had no way of protecting themselves (brief of not opening documents). Had MOICE been available these customers could have deployed it to mitigate these attacks.”
Additional info: The National Security Agency published a fact sheet on Wringer, as well as a Wringer deployment guideline.
Got a Microsoft code name you’ve been wondering about? Send it my way. All submitters will be kept confidential.Meanwhile,Microsoft Office Pro Plus 2010, if you want to keep track with the full month’s worth of Microsoft code names I end up posting,Microsoft Office 2010 Professional Plus, bookmark this “Microsoft Codenames” page.
“(B)asically what MOICE does is it hijacks the file associations inside the registry and redirects them to a process called ‘MOICE.EXE;. This process basically spawns the Workplace 2007 file format converter to up-convert the double-clicked Workplace 2003 document towards the new Open XML file format. Oh and the converter runs in its own desktop with a super-locked down token (Dave is the freaking man,Microsoft Office Pro 2010!). Why run the converter in its own desktop with a super restricted token? Simple - what if the act of converting the file leads to an exploitable bug and / or code execution. This is effectively dropping the rights with the logged on user to *below* standard user levels in order to do the file conversion. Anyhoo - after the file is up-converted to the new Office 2007 file format - the theory is that the vulnerability will have been ‘wrung; out (indeed the code name for this task was ‘Wringer;).”
Back story: Office remains a big hacker target — something of which Microsoft is quite aware. As Hensing blogged:
“(I)t;s no secret that Office was employed in some targetted attacks final year . . . some attacks involving 0-day vulnerabilities for which our customers had no way of protecting themselves (brief of not opening documents). Had MOICE been available these customers could have deployed it to mitigate these attacks.”
Additional info: The National Security Agency published a fact sheet on Wringer, as well as a Wringer deployment tutorial.
Got a Microsoft code name you’ve been wondering about? Send it my way. All submitters will be kept confidential.