Forgery Detection Mechanism with Abnormal Structure Analysis on Office Open XML based MS-Word File

다국어 초록 (Multilingual Abstract)

We examine the weaknesses of the existing OOXML-based MS-Word file structure, and analyze how data concealment and forgery are performed in MS-Word digital documents. In case of forgery by including hidden information in MS-Word digital document, there is no difference in opening the file with the MS-Word Processor. However, the computer system may be malfunctioned by malware or shell code hidden in the digital document. If a malicious image file or ZIP file is hidden in the document by using the structural vulnerability of the MS-Word document, it may be infected by ransomware that encrypts the entire file on the disk even if the MS-Word file is normally executed. Therefore, it is necessary to analyze forgery and alteration of digital document through internal structure analysis of MS-Word file. In this paper, we designed and implemented a mechanism to detect this efficiently and automatic detection software, and presented a method to proactively respond to attacks such as ransomware exploiting MS-Word security vulnerabilities.

참고문헌 (Reference)

1 Wikipedia contributors, "Zip (file format)"

2 Wikipedia contributors, "SHA-2"

3 Wikipedia contributors, "Office Open XML"

4 Wikipedia contributors, "JPEG"

5 "GandCrab ransomware operation says it's shutting down. By Catalin Cimpanu"

6 "File Formats: Microsoft Word Document (DOCX/DOC)"

7 Wikipedia contributors, "Digital forensics"

8 "CVE-2017-3867 Detail"