I recently heard that hackers can steal information from your hard drive using Microsoft Word. Is this true?
The Document Collaboration Spyware exploit, as it is being called, filches files via Microsoft Word fields.
Fields let you insert self-updating information into documents. For example, select Insert | Page Numbers... from the Word menu and you're actually inserting a self-updating Page field. A field called IncludeText can insert entire Word documents or Excel worksheets. Two features of fields make them a potential problem: They update automatically under some conditions, and there are a number of ways to hide them.
Suppose you received a document for comment, edited it, and sent it back. If the document contained a hidden IncludeText field that specified the locations and names of files your system can access, those files could have been sent back as part of the original file.
For this to work, an interloper has to know the names of the files and their locations, but if the person works with you, the possibility is not too far-fetched. This trick lets someone without access to certain network folders use your access to get files stored in those folders.
There are some steps you can take to minimize your vulnerability. You can use Edit | Links to see if there's a list of links in a file. You can also search manually for fields and examine each one. Choose Tools | Options | View. Make sure that the Field codes box is checked and that Field shading is set to Always, which will help you spot the fields. Unfortunately, this can be a chore. When Word is set to show field codes, you can use Edit | Find to search for IncludeText and similar fields, but there are several, and you have to search for each separately.
As of this writing, there is at least one tool that can help: Bill Coan's Hidden File Detector, which you can download from www.wordsite.com/HiddenFileDetector.html or from www.woodyswatch.com/util/sniff/. Hidden File Detector adds a new item, Detect Hidden Files, to the Tools menu. Choose this item and you'll see a dialog box that lists any documents inserted into the file by a potential spyware field. You can then select each document to see a short description of the suspect field. Clicking on the Go to button will take you directly to the highlighted field.