Microsoft Office privacy threat uncovered

A privacy organisation has warned that authors can track the path of Microsoft Office documents by attaching so-called 'web bugs' to them before they are forwarded to recipients.

According to an advisory statement issued by the US Privacy Foundation (USPF), web bugs could be used by organisations or individuals to monitor the journey of Word, Excel or PowerPoint files when they are read by third parties.

Web bugs are made possible by a facility which allows Microsoft Office applications to link documents to a web-based image file. Once the image file is accessed, a remote server can recognise when and where a document file is opened by referring to the IP address and host name of the responding computer.

Richard Smith, technical director at the USPF, also warned that the bugs could be used to read and write browser-based cookies inside Word documents. Cookies are pieces of software used by websites to collect data about visitors so they can be identified on revisiting a site.

"We are concerned about the whole blurring between desktop [applications] and the web and this is where problems can occur," he said. But he admitted that the USPF has found no evidence that web bugs are actually being used in Word documents.

Microsoft confirmed that Word can access the internet to fetch web images, thereby making the use of web bugs possible, but the software giant claimed there is no evidence of such activities occurring. Although it said users could choose to disable cookies from browsers, the USPF has recommended to Microsoft that cookies should be disabled in Word through a software patch.

According to Smith, web bugs have been used by advertising companies to track the effectiveness of campaigns by attaching them to email messages, but bugs in Word files could allow companies to detect and track leaks of confidential documents and monitor whether chunks of texts are being copied in contravention of copyright laws.

Web bugs could also be attached to MP3 files that support embedded HTML to track the whereabouts of songs downloaded from the internet, added Smith.