2

For an organization working mainly with xls, pdf and doc files (but also other MS Office tools), how should it deal with metadata? How can we scan all documents and strip the metadata from them?

  • This is a management decision. If you feel that metadata from these documents can be used by an attacker to gain more info about the systems, then strip the data. – Yorick de Wid Jan 18 '16 at 15:24
  • @YorickdeWid: updated question. – Quora Feans Jan 18 '16 at 15:28
  • Office has an option to remove some of the data. part of the privacy settings. This works for your local installation, but not for the entire organisation of course. – Yorick de Wid Jan 18 '16 at 15:30
3

Metadata can potentially provide information that an attacker would find valuable. For example, the author value can reveal the organization's username convention, which could be later used in conjunction with password guessing or social engineering. The software used to create the file can also be potentially usable for an attacker if the target is using out of date software with known vulnerabilities. The best practice would be to scrub metadata, but it comes down to a business management decision of whether the risk is significant enough to spend time removing the data. There are several easily available tools for metadata inspection and removal.

2

Exiftool is excellent at viewing/editing document metadata. It's also multi-platform -http://www.sno.phy.queensu.ca/~phil/exiftool/
You can run it with the recursive switch so it can process all files in the current directory and all subdirectories. You could even write a bat one liner so it will be a set and forget operation to cleanse all metadata in the current folder and all subfolders.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.