Didier Stevens

Monday 4 April 2022

.ISO Files With Office Maldocs & Protected View in Office 2019 and 2021

Filed under: maldoc,Malware,Uncategorized — Didier Stevens @ 0:00

We have seen ISO files being used to deliver malicious documents via email. There are different variants of this attack.

One of the reasons to do this, is to evade “mark-of-web propagation”.

When a file (attached to an email, or downloaded from the Internet) is saved to disk on a Windows system, Microsoft applications will mark this file as coming from the Internet. This is done with a ZoneIdentifier Alternate Data Stream (like a “mark-of-web”).

When a Microsoft Office application, like Word, opens a document with a ZoneIdentifier ADS, the document is opened in Protected View (e.g., sandboxed).

But when an Office document is stored inside an ISO file, and that ISO has a ZoneIdentifier ADS, then Word will not open the document in Protected View. That is something I observed 5 years ago.

But this has changed recently. When exactly, I don’t know (update: August 2021).

But when I open an Office document stored inside an ISO file marked with a ZoneIdentifier ADS, Office 2021 will open the document in protected view:

With an unpatched version of Office 2019, that I installed a year ago, that same file is not opened in Protected View:

After updating Office:

Word’s behavior has changed:

The file is now opened in Protected View.

If you want to test this yourself, you can use my ZoneIdentifier tool to easily settings a “mark-of-web” without having to download your test file from the Internet:

Or you can just add the ZoneIdentifier ADS with notepad.

I did the same test with Office 2016, I updated an old version and: the document is not opened in Protected View.

I don’t know exactly when Microsoft Office 2019 was updated so that it would open documents in Protected View when they are inside an ISO file marked as originating from the Internet. But if you do know, please post a comment.

Update: this change happened in August 2021. See comments below. Thanks Philippe.

Comments (2)

Sunday 3 April 2022

Power Consumption Of A Philips Hue lamp In Off State

Filed under: Hardware,technology — Didier Stevens @ 17:25

A Philips Hue lamp is a LED lamp that can be controlled wirelessly. It always draws power for its control circuitry, also when the LED is turned off.

I wondered how much power it consumes in the off state. Doing some research, I found a couple of forums where people asked the same question, and getting answers that is was very little, varying from 0,01 A to 0,02 A.

I got similar results for the current when I measured this:

Figure 1: Switched off Philips Hue drawing 0,0175 A (varying easily with 25%)

But I wanted a more precise answer, and not only the current. I am more interested in the power (Watt) consumption. As our domestic electricity meters measure real power over a period of time.

Thus I measured the power consumption of a 1100 Lumen color Philips Hue lamp that I had switched of via the smartphone app over a period of 10 days.

And these are the numbers I got after 10 days:

Figure 3: After 10 days of operation in the off state

0,07756 kWh over a period of 10 days, that’s 0,32316 W. Notice that the display indicates KWh, but that should be kWh (lowercase k for kilo).

Extrapolating to a whole year, that’s 2,831 kWh. Which in my case, correspond to a cost of €1,50 (roughly speaking) per lamp per year.

With online numbers claiming the current to be between 0,01 A and 0,02 A, at first I expected the power consumption to be higher. But the power factor is quite low (around 0,10), explaining a lower power consumption.

Update 2022/09/01: I redid the test for one day (24 hours) using a more precise powermeter (GPM 8310) and measured 8,9188 Wh for 24 hours, or 0,3713 W.

Comments (3)