Can Google Docs be used to “sanitize” a word or excel document?

Question

Sometimes I have to download some word or excel documents from incredible sites. I need not only to read but also to edit them. I heard that Microsoft Office suite is a very popular attack vector. Although I patch my windows and office regularly I guess there must be many 0day vulnerabilities in them. In order to mitigate the risk, after downloading a word document, I would upload it to the Google Docs, make some small changes and download it with a different format (for example, if the original file is a *.doc file then I would download it as a *.docx file and vise versa). I guess such conversion may "sanitize" (or at least break) the malicious code (if any) in the suspicious file but I am not sure whether it does work.

So, does anyone know whether it works?

Answer 1

Microsoft has a tool that does exactly this, MOICE, Microsoft Office Isolated Conversion Environment(2007 release not sure if this has been updated).

https://docs.microsoft.com/en-us/security-updates/securityadvisories/2007/937696

What you are trying to achieve with Google Docs will work as well. Essentially, exploits that are targeting the victim are written for a specific platform/parser and when you change the format, the exploit will not work. Can someone build an exploit that may survive that format change? Why not, but I haven't heard anyone achieve that (although it has been demonstrated that multi-platform malware exist but very very rare).