Plugin Spotlight: Office Files List
Attackers have access to a great deal of public information about your organization. Public web sites, domain records, routing information and several other sources can provide an attacker with useful information to launch attacks. Public documents posted on your web site contain metadata that can be very useful to an attacker. Metadata, in the context of the documents created within your organization, is information about the document itself. This can include who created it, their email address, the creation date, the software used to create and publish it and the software version and platform. This information can then be used to create client-side attacks that specifically target individuals and the software they are using.
Nessus plugin 11419, Office files list, attempts to discover the documents that are located on the target web site. Currently this plugin checks for the following document types:
| *.doc | MS Word |
| *.wri | Write |
| *.xls | MS Excel |
| *.ppt | MS PowerPoint |
| *.csv | Generic Spreadsheet |
| *.dif | spreadsheet |
| *.rtf | Generic Word Processor |
| Adobe Acrobat PDF | |
| *.sxw | Open Office Writer |
| *.sxi | Open Office Presentation |
| *.sxc | Open Office Spreadsheet |
| *.sdw | StarWriter |
| *.sdd | StarImpress |
| *.sdc | StarCalc |
Running this plugin against web sites produces a report that lists each document and type found:
When performing vulnerability scans and assessments against your web servers, make sure you also examine the documents being distributed on the web server. Manual inspection is required to ensure that no sensitive information is contained within the document. A further step is required to ensure that document metadata has been removed. Periodic audits using Nessus, especially of your public facing web servers, will aid in the discovery of documents that may leak too much information to attackers. Plugin 11419 helps you find this information before the attackers do.You may also consider implementing a “Metadata Scrubber”, such as the Office add-in made freely available by Microsoft called “Remove hidden data”.
Resources
- "Document Metadata, The Silent Killer" Research Paper by Larry Pesce
- Office 2007 Metadata - Video tutorial on how to extract metadata from Office 2007 documents
- FOCA - An online or downloadable tool for extracting document metadata
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
Cybersecurity Snapshot: New Guides Offer Best Practices for Preventing Shadow AI and for Deploying Secure Software Updates
October 25, 2024Looking for help with shadow AI? Want to boost your software updates’ safety? New publications offer valuable tips. Plus, learn why GenAI and data security have become top drivers of cyber strategies. And get the latest on the top “no-nos” for software security; the EU’s new cyber law; and CISOs’ communications with boards.
- Nessus