Hacker Tries To Sell Excel Flaw On EBay - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

01:04 PM

Hacker Tries To Sell Excel Flaw On EBay

According to the since-yanked listing, the zero-day vulnerability in Excel had been reported to Microsoft on Dec. 6. "It can be assumed that no patch addressing this vulnerability will be available within the next few months," the seller wrote.

An unknown security researcher tried to sell a vulnerability in Microsoft's Excel spreadsheet program on eBay, but the online auction site pulled the listing late Thursday.

The unusual route to vulnerability profit-taking was squashed by eBay after the listing--offered by someone only identified as "fearwall"--was bid up to just under $60.

According to the since-yanked listing, the zero-day vulnerability in Excel had been reported to Microsoft on Tuesday, Dec. 6. "All the details were submitted to Microsoft, and the reply was received indicating that they may start working on it," wrote the seller. "It can be assumed that no patch addressing this vulnerability will be available within the next few months."

The unpatched vulnerability is in the way that Excel, the popular spreadsheet included in all editions of Microsoft's Office suite, validates the data in some worksheets when it parses files.

"The vulnerability can be exploited to compromise a user's PC," claimed the seller.

He also took several potshots at Microsoft, saying that the opening bid of $.01 was "a fair value estimation for any Microsoft product" and offered a 10 percent discount to any Microsoft employee who mentioned the discount code "LINUXRULZ."

A spokeswoman for Microsoft confirmed that the listing on eBay was for a real bug in Excel. "The Microsoft Security Research Center has not been made aware of any attacks attempting to use the reported vulnerability or customer impact at this time, but [it] will continue to investigate the public reports to help provide additional guidance for customers," she said in an e-mail to TechWeb.

The spokeswoman also said that Microsoft's researchers were investigating the vulnerability, and might (or might not) release either a fix or a security advisory in the future.

"The company is working with eBay to determine the appropriate course of action," she also said.

[Update, Monday, Dec. 12; 12:45 pm: The original article included the phrase "against the seller" after the preceding quote, outside of the quotation marks. That was incorrect; Microsoft is working with eBay to determine a general course of action to protect its customers. ]

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
The State of Chatbots: Pandemic Edition
Jessica Davis, Senior Editor, Enterprise Apps,  9/10/2020
Deloitte on Cloud, the Edge, and Enterprise Expectations
Joao-Pierre S. Ruth, Senior Writer,  9/14/2020
Data Science: How the Pandemic Has Affected 10 Popular Jobs
Cynthia Harvey, Freelance Journalist, InformationWeek,  9/9/2020
Register for InformationWeek Newsletters
Current Issue
IT Automation Transforms Network Management
In this special report we will examine the layers of automation and orchestration in IT operations, and how they can provide high availability and greater scale for modern applications and business demands.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll