One of our researchers, Sami Rautiainen, produced a paper for the Virus Bulletin Conference in September of 2003 on the topic of OpenOffice Security. The conclusions that he reached: The macro language and the API of OpenOffice are very powerful, but unfortunately the power can be abused for malicious purposes. The security settings in the default installation of OpenOffice much resembles older versions of Microsoft Office. You can download the paper in PDF format here.



That was then, and now� we have a proof-of-concept sample for OpenOffice.org named Stardust.A. This thing is very buggy and is not something in the wild, it's classified as intended, but it's interesting to note that the waters are indeed being tested.

Updated to Add: Terms used in this post were updated on June 6, 2006.