Sean Wallbridge
What
A friend (let’s call him “Barney”) recently discovered something that might freak others out, much like it did to him, briefly. And I thought I should do a quick public service here as I have no doubt it will come to a surprise to others.
He was on his Office 365 (well, rather, SharePoint Online) My Site (Personal Site) and discovered that there were a number of files listed as “Recent Documents” that did not look familiar to him. And when he hovered his mouse over them, they weren’t documents from our organization. The URL’s in fact, pointed to IP addresses and not common URL’s like https://companyname.sharepoint.com, etc.
Stranger still, after building up the courage to click on the document links, they went to dead links. They weren’t there, gone, nada.
Whoa! Have I been hacked? Is someone reading on my documents? Crap on a cracker!
So What
Well, after pausing to reflect and gather our wits, we thought this through. Here’s what happened…
- He installed Office 2013, from the Office 365 Portal, at work. This was on a newly formatted desktop with no document history other than a few documents he had created. No big deal, SharePoint Online/Recent Documents looked fine
- He installed Office 2013 at home, from the Office 365 Portal as well. He is entitled to, both as an employee but also because his Office 365 account is an E3 and includes 5 (five) copies of Office, meaning he can run it on all the machines he accesses (awesome move by the way Microsoft!)
- Note, this second PC, at home, was an older one. It had a previous version of Office on it (2010 I believe) and thus the Office installed was an “upgrade”. No matter, the “recent documents” from that machine was also tied into the account, as the Office 2013 was licensed to the same Office 365 account
It took a little bit of thinking this through to come to the conclusion but here is where we landed:
- The home PC was used for a previous job and Excel (the main “foreign document” in question) was rarely used at home
- When we did an NSLookup against the IP addresses in the now dead URL’s, it turned out to be IP’s belonging to systems run by his previous employer
Ahso. There you have it. Files that haven’t been looked at in years, from IP’s that made sense, on a machine who’s Excel “Recent History” hadn’t changed in 2+ years.
I love it when shit makes sense. Panic over. Serenity Now.
Now What
When installing Office 2013/Office 365 onto multiple machines, keep in mind that on any machines that previously had Office installed, their “recent items” from applications like Word, Excel, PowerPoint, etc., will get slurped up into your “Recent Documents” display and merged. Particularly now that an Office 365 E3 plan includes 5 (yes FIVE!) copies of Office that can be installed at work, at home, on a tablet, etc. “recent documents” can come from a number of places.
At the end of the day, always be careful before clicking on anything you don’t recognize. But don’t panic, if the above happens to you.