Stardust virus lands on OpenOffice

By Joris Evers, News.com
Posted on ZDNet News: May 31, 2006 5:30:00 PM

The virus, dubbed Stardust, is capable of infecting OpenOffice and StarOffice, which is sold by Sun Microsystems, a Kaspersky Lab researcher wrote on the Russian company's Viruslist Web site on Tuesday.

"Stardust is a macro virus written for StarOffice, the first one I've seen," the researcher wrote. "Macro viruses usually infect MS Office applications."

The pest is written in Star Basic. It downloads an image file with adult content from the Internet and opens that file in a new document, according to Kaspersky's posting.

Macros are a useful part of any office suite, allowing users to automate repetitive tasks. "These tasks include potentially destructive actions, such as modifying and deleting files, which is why macros are of interest to virus writers," the OpenOffice team wrote in a response to the virus.

To mitigate against the macro virus risk, OpenOffice detects if a document contains macros, displays a warning and will only run the macro if the user chooses to do so, the OpenOffice team wrote.

So far, Stardust is a proof-of-concept virus, which means that it was created to demonstrate that an OpenOffice virus is possible. The virus has not been sent out in the wild and is not actually attacking people's systems.

The story is different for Microsoft Office applications: A yet-to-be-patched security hole in Word has been exploited in at least one recent cyberattack.

A new "macro virus" is like a blast from the past. Viruses have evolved significantly. Boot sector pests were around between 1986 to 1995, followed by macro viruses that exploited early Microsoft Windows operating systems, according to security company F-Secure. The advent of e-mail subsequently propelled e-mail viruses such as the "I Love You" and the Anna Kournikova virus.