This behavior is annoying as hell, but I also think it's for the best. Excel specifically was way too trusting, has a full development environment with the ability to auto-run macros, and has become a convenient vector for delivering malicious code.
I once made an xlsx with a VBA module and put it in my often-late coworkers' startup folder. It would check log-on time and if it was between 9:01am and 9.59am it would send an email to the rest of the team apologizing for being late that day.
Stunning that I could do that on what was supposedly a locked-down internal system.
I once used VBA to script and automate 90% of my old desk job. I just needed a way to automate keyboard input and some basic conditional controls.
I couldn't install python or run batch scripts as the machine was heavily locked down, but luckily MS provided all the tools I needed inside excel. System admins hate this one trick, thanks microsoft!
You just enable the VB script to check the system time on launch and auto close silently if outside those times.
Excel integrates with all Microsoft products so it can access Outlook and send an email. You populate the email fields as you want and put it inside an if loop of the times and exit. Even without outlook I think it might be able to send emails with some plug-ins or via a browser window, navigate to mail, and do basic webscraping and clicking like you'd do with Beautiful Soup or AHK.
The whole setup can just be worked out with some googling and stack exchange threads.
It was a running joke he was always late and it wasn't exactly the best run company so there was no negative outcomes really, just harmless fun.
My workplaces malwarebyte's settings end the excel process tree if it tries to run a script that accesses other M$ products.
Was super annoyed when I discovered that while trying to script in an email template for the form I was making, since at the time staff never cc'd the correct people and would then bitch out finance for not paying them.
There is malware that can infect you simply by opening an office document. One of the cooler security trainings I've been through was a recorded demo of it. Opened a doc on one computer, enabled editing, then another computer was able to extract credentials from ram or something.
Instead of asking why your word processor should have the ability to run arbitrary code, you just inconvenience everyone else on the chance it might. What even.
VBA for Word is bad, but VBA for Excel graphs is worse. At small companies that can't justify the cost of any software outside Office, people will go to great lengths to get Excel to support data analysis. Not being in that situation anymore is one of my top satisfaction items with having changed jobs from a small to a large company.
I used to work at a place where one of their test machines generated a cert in Microsoft Word with test results. They were having their lab technicians manually type in something like eight fields of information to flesh put the cert. I managed to hack together a Word VBA plus Python script to interface with the OpenOffice database I had set up so the techs only had to type in one field, and the script filled in the rest.
It was kind of a monstrosity under the hood, but it worked pretty slickly, and given the available tools I was glad the option existed.
Just TODAY I generated a text file via a bash script, and when attempting to open it in Notepad++ Windows insisted on warning me about potential hazards because it couldn't verify who created the file. A text file! Heavens. I wonder how long I'll last in that blasted Windows centric environment.
I call BS. More likely notepad++ attempted to update and their new installer is no longer signed as the developer has been having issues getting a new signing certificate based on the app name (they want a legal identity).
No, Windows Explorer itself does this when attempting to access network files under some byzantine set of conditions I've never been able to get to the bottom of. For instance, my machine at work bitches at me whenever I attempt to open or copy any log file (which is obviously just a text file) from either of my Linux based servers.
I use Notepad++ also, and trying to open one of these files either from Explorer or the file open dialog in NP++ triggers the warning.
I literally did it just now to generate this screenshot.
Okay that is a common error when accessing unknown network shares and network settings are misconfigured. Need to add whatever IP or network name to intranet zone. It's not to do with the file type or contents.
Nothing compares to the foolish audacity of excel to switch numbers to scientific notation by default. This can't possibly be the most commonly desired outcome. Its the most annoying "feature" they have that has existed forever.
In the example you're talking about the scientists were using it as a database. A Microsoft executive even came out and told them that you shouldn't use it as a database.
Occasionally there's even articles in scientific journals explaining why you shouldn't use Excel as a database and suggesting alternatives. But for some reason people still turn to their favourite not database database software.
Im sorry, the auto date formating is by far the worst. Just leave my numbers the fuck alone man, numbers are supposed to be precise, judt dont fucking touch em. Rant over lol
Microsoft office documents not running in protected mode can run arbitrary code on your computer. Given VBA that arbitrary code can pretty much access anything any installed application can.
There's a load of Office malware written that can infect all the documents on your system with keyloggers and password scrapers.
It's a pain in the ass yeah, but it exists to mitigate a very real risk.
Microsoft managed to build a file format for spreadsheets, text documents and such, which can be used to run arbitrary code on the PC where it's opened (via VBA). In a move that no one could have predicted, this is used to distribute malware.
And their bandaid fix is this "Protected Mode", which is entered when you receive a document from another organization. In Protected Mode, it does not run VBA code until you exit it.
Unfortunately, their solution has conditioned users to basically always exit Protected Mode.
The annoying part is, they could check if the file even contains malicious code. But they don’t and instead default to protected mode, even for basic files.
As someone who never did anything dodgy with a computer in my time. Its cos Microsoft files opened not in protected views can embed and execute macros. These macros are essentially a remote code execution. Mostly not used anymore (defaults to disabled macros) but plenty of large orgs still have macros enabled cos legacy bullshit.
U can do similar with some font formats, screensavers, and a multitude of unexpected things that most people think are completely safe. That's how linustechtips was got rce through screensaver disguised as PDF that installed a rat and token stealer that stole live YouTube session tokens. U can also use the victim device as an exit for routing traffic as a reverse proxy so tokens appear to be coming from the same device to avoid triggering security warnings.
Tldr don't enable it for random files from dubious sources and check the file extensions else u will get hacked.
Also malicious web pages. You might need to do slightly more than opening the page, but with all the captcha and similar prompts people are click happy today.
Personally surprised there aren't more attacks that mimic the click to prove you aren't a robot and other captcha prompts.
I hope the EU sues the shit out of MS some time for this "feature". Write protection is one of the few things Libreoffice can't handle well, and from my perspective, that is the entire reason they have it. Also, funny enough, Office 362, their own fucking product, also can't handle it. So you need a computer where you can install the desktop version, just to untick the fucking "write-protected" box and do your job.
In academic research, you often have to apply for money from funding agencies, using write-protected templates. If you don't use the exact template or if it looks distorted in some way, you're out (of consideration for the funding, and long-term out of your job).
73 Comments
CaptDust@sh.itjust.works · 146 pts · 340d
This behavior is annoying as hell, but I also think it's for the best. Excel specifically was way too trusting, has a full development environment with the ability to auto-run macros, and has become a convenient vector for delivering malicious code.
funkless_eck@sh.itjust.works · 94 pts · 340d
I once made an xlsx with a VBA module and put it in my often-late coworkers' startup folder. It would check log-on time and if it was between 9:01am and 9.59am it would send an email to the rest of the team apologizing for being late that day.
Stunning that I could do that on what was supposedly a locked-down internal system.
CaptDust@sh.itjust.works · 70 pts · 340d
I once used VBA to script and automate 90% of my old desk job. I just needed a way to automate keyboard input and some basic conditional controls.
I couldn't install python or run batch scripts as the machine was heavily locked down, but luckily MS provided all the tools I needed inside excel. System admins hate this one trick, thanks microsoft!
funkless_eck@sh.itjust.works · 13 pts · 340d
haha yeah same. We had this terrible internal CMS that I would automate the hell out of.
parody@lemmings.world · 8 pts · 340d
LOL pls say more
funkless_eck@sh.itjust.works · 25 pts · 340d
You just enable the VB script to check the system time on launch and auto close silently if outside those times.
Excel integrates with all Microsoft products so it can access Outlook and send an email. You populate the email fields as you want and put it inside an if loop of the times and exit. Even without outlook I think it might be able to send emails with some plug-ins or via a browser window, navigate to mail, and do basic webscraping and clicking like you'd do with Beautiful Soup or AHK.
The whole setup can just be worked out with some googling and stack exchange threads.
It was a running joke he was always late and it wasn't exactly the best run company so there was no negative outcomes really, just harmless fun.
DarkSirrush@lemmy.ca · 8 pts · 340d
My workplaces malwarebyte's settings end the excel process tree if it tries to run a script that accesses other M$ products.
Was super annoyed when I discovered that while trying to script in an email template for the form I was making, since at the time staff never cc'd the correct people and would then bitch out finance for not paying them.
TempermentalAnomaly@lemmy.world · 7 pts · 339d
What in the actual fuck.
laserjet@lemmy.dbzer0.com · 4 pts · 338d
what an incredible jackass
TrickDacy@lemmy.world · 31 pts · 340d
I mean, if people weren't desensitized to warnings like this by getting them constantly, I think you'd be right
shalafi@lemmy.world · 8 pts · 340d
In IT we have to consider the signal to noise ratio of warning users.
chisel@piefed.social · 81 pts · 340d
There is malware that can infect you simply by opening an office document. One of the cooler security trainings I've been through was a recorded demo of it. Opened a doc on one computer, enabled editing, then another computer was able to extract credentials from ram or something.
NKBTN@feddit.uk · 35 pts · 340d
They're borderline works of genius, some of them
muntedcrocodile@hilariouschaos.com · -1 pts · 340d
Not really that genius pretty script kiddy stuff now. U can create ur own in like 5minutes with metasploit.
MycelialMass@lemmy.world · 4 pts · 339d
Ya but the OGs who figured it out
muntedcrocodile@hilariouschaos.com · 0 pts · 339d
Fair
nek0d3r@lemmy.dbzer0.com · 61 pts · 340d
Instead of asking why your word processor should have the ability to run arbitrary code, you just inconvenience everyone else on the chance it might. What even.
CaptDust@sh.itjust.works · 32 pts · 340d
Yup, it's a shit bandaid to mitigate a shit design. The MS specialty.
shalafi@lemmy.world · 9 pts · 340d
Scripting is great in Excel, but I've never encountered or heard of a use for it in Word.
SirActionSack@aussie.zone · 6 pts · 340d
That's partly because the API for manipulating word docs with VBA is incredibly awful.
Lyrl@lemmy.dbzer0.com · 1 pts · 338d
VBA for Word is bad, but VBA for Excel graphs is worse. At small companies that can't justify the cost of any software outside Office, people will go to great lengths to get Excel to support data analysis. Not being in that situation anymore is one of my top satisfaction items with having changed jobs from a small to a large company.
Lyrl@lemmy.dbzer0.com · 1 pts · 338d
I used to work at a place where one of their test machines generated a cert in Microsoft Word with test results. They were having their lab technicians manually type in something like eight fields of information to flesh put the cert. I managed to hack together a Word VBA plus Python script to interface with the OpenOffice database I had set up so the techs only had to type in one field, and the script filled in the rest.
It was kind of a monstrosity under the hood, but it worked pretty slickly, and given the available tools I was glad the option existed.
sp3ctr4l@lemmy.dbzer0.com · 6 pts · 339d
Yep.
A constant stream of creating problems and then creating solutions for those problems, which cause more problems....ad infinitum.
Go back and fix the root cause?
Impossible!
Then our 2nd and 3rd tier 'solutions' would have all the 'solutions' based on them not work!
noughtnaut@lemmy.world · 52 pts · 340d
Just TODAY I generated a text file via a bash script, and when attempting to open it in Notepad++ Windows insisted on warning me about potential hazards because it couldn't verify who created the file. A text file! Heavens. I wonder how long I'll last in that blasted Windows centric environment.
bleistift2@sopuli.xyz · 48 pts · 340d
Not so far-fetched when you realize that Windows crams AI into everything and the text file might contain malicious instructions.
TrickDacy@lemmy.world · 15 pts · 340d
Yeah, but honestly it wouldn't even need AI to have this issue with the kind of bloated spaghetti code that MS seems to produce.
noughtnaut@lemmy.world · 3 pts · 339d
It was a text file with 80 rows of `username="username username@example.com" mappings (for an svn to git conversion). Nothing nefarious.
lazynooblet@lazysoci.al · 6 pts · 340d
I call BS. More likely notepad++ attempted to update and their new installer is no longer signed as the developer has been having issues getting a new signing certificate based on the app name (they want a legal identity).
dual_sport_dork@lemmy.world · 4 pts · 339d
No, Windows Explorer itself does this when attempting to access network files under some byzantine set of conditions I've never been able to get to the bottom of. For instance, my machine at work bitches at me whenever I attempt to open or copy any log file (which is obviously just a text file) from either of my Linux based servers.
I use Notepad++ also, and trying to open one of these files either from Explorer or the file open dialog in NP++ triggers the warning.
I literally did it just now to generate this screenshot.
lazynooblet@lazysoci.al · 1 pts · 337d
Okay that is a common error when accessing unknown network shares and network settings are misconfigured. Need to add whatever IP or network name to intranet zone. It's not to do with the file type or contents.
noughtnaut@lemmy.world · 3 pts · 339d
It was most certainly not Notepad trying to update, it very definitely was Windows intercepting the file open process.
lime@feddit.nu · 1 pts · 340d
the ongoing security nightmare that is the np++ auto-update mechanism continues to generate content
Sarmyth@lemmy.world · 31 pts · 339d
Nothing compares to the foolish audacity of excel to switch numbers to scientific notation by default. This can't possibly be the most commonly desired outcome. Its the most annoying "feature" they have that has existed forever.
BanMe@lemmy.world · 25 pts · 339d
Hey. Look at that column of dates you got. Would be a shame if they got converted to random numbers.
piecat@lemmy.world · 13 pts · 339d
Hey that's a cool sequence of genes. Would be a shame if we converted a few into date format when you try to save as .csv
echodot@feddit.uk · 1 pts · 338d
Sure but at the same time they shouldn't be using Excel as a database.
piecat@lemmy.world · 0 pts · 338d
Nobody does that?
echodot@feddit.uk · 1 pts · 338d
In the example you're talking about the scientists were using it as a database. A Microsoft executive even came out and told them that you shouldn't use it as a database.
Occasionally there's even articles in scientific journals explaining why you shouldn't use Excel as a database and suggesting alternatives. But for some reason people still turn to their favourite not database database software.
piecat@lemmy.world · 2 pts · 338d
This isn't a live or massive dataset. It's a table of data from the samples that were sequenced.
CSV is a perfectly adequate format for the work being done. Actually, Excel's bug-as-a-feature is the only reason you wouldn't want to use it.
MycelialMass@lemmy.world · 13 pts · 339d
Im sorry, the auto date formating is by far the worst. Just leave my numbers the fuck alone man, numbers are supposed to be precise, judt dont fucking touch em. Rant over lol
xxce2AAb@feddit.dk · 25 pts · 340d
Like trying to have sex in a full body plaster cast.
Empricorn@feddit.nl · 7 pts · 340d
The chafing...
androidul@lemmy.world · 6 pts · 340d
at least you’re havin’ sex …
xxce2AAb@feddit.dk · 5 pts · 340d
Not in a full body plaster cast I'm not.
ThePantser@sh.itjust.works · 4 pts · 340d
They didn't leave a hole for peepee and poopoo?
xxce2AAb@feddit.dk · 14 pts · 340d
While we could have a serious academic discussion about the logistics of full body plaster cast sex dynamics, we could also... not.
TabbsTheBat@pawb.social · 15 pts · 340d
As someone who doesn't use microsoft stuff.. anyone here have an explanation? lol
Pirky@lemmy.world · 40 pts · 340d
9point6@lemmy.world · 20 pts · 340d
Microsoft office documents not running in protected mode can run arbitrary code on your computer. Given VBA that arbitrary code can pretty much access anything any installed application can.
There's a load of Office malware written that can infect all the documents on your system with keyloggers and password scrapers.
It's a pain in the ass yeah, but it exists to mitigate a very real risk.
Miaou@jlai.lu · 7 pts · 340d
It doesn't mitigate anything when it pops every single time. Microsoft on its own has rendered scary messages useless with how often they use them.
muntedcrocodile@hilariouschaos.com · 1 pts · 340d
U would want to install a rat or do a browser token theft. Why bother with a keyloggers when u can steel access codes from the browser directly.
TabbsTheBat@pawb.social · 7 pts · 340d
Thamks :3.. I can see why that would be annoying lol
darklamer@lemmy.dbzer0.com · 3 pts · 338d
muntedcrocodile@hilariouschaos.com · 1 pts · 340d
What company do u work at? Cos one well placed email with a dodgy file attached could destroy the entire company.
Ephera@lemmy.ml · 17 pts · 340d
Microsoft managed to build a file format for spreadsheets, text documents and such, which can be used to run arbitrary code on the PC where it's opened (via VBA). In a move that no one could have predicted, this is used to distribute malware.
And their bandaid fix is this "Protected Mode", which is entered when you receive a document from another organization. In Protected Mode, it does not run VBA code until you exit it.
Unfortunately, their solution has conditioned users to basically always exit Protected Mode.
bleistift2@sopuli.xyz · 6 pts · 340d
The annoying part is, they could check if the file even contains malicious code. But they don’t and instead default to protected mode, even for basic files.
lemming741@lemmy.world · 6 pts · 340d
It's probably spaghetti enough that just loading it to check would be exploitable.
muntedcrocodile@hilariouschaos.com · 10 pts · 340d
As someone who never did anything dodgy with a computer in my time. Its cos Microsoft files opened not in protected views can embed and execute macros. These macros are essentially a remote code execution. Mostly not used anymore (defaults to disabled macros) but plenty of large orgs still have macros enabled cos legacy bullshit.
U can do similar with some font formats, screensavers, and a multitude of unexpected things that most people think are completely safe. That's how linustechtips was got rce through screensaver disguised as PDF that installed a rat and token stealer that stole live YouTube session tokens. U can also use the victim device as an exit for routing traffic as a reverse proxy so tokens appear to be coming from the same device to avoid triggering security warnings.
Tldr don't enable it for random files from dubious sources and check the file extensions else u will get hacked.
moody@lemmings.world · 4 pts · 340d
So disable macros until enabled. But protected view won't even let you edit a text document.
muntedcrocodile@hilariouschaos.com · 1 pts · 340d
Yeah Idk why that is all I know is macros will ruin ur life if ur not careful. Luckily I run QubesOS so not a problem I'm too concerned with.
onslaught545@lemmy.zip · 5 pts · 340d
Microsoft documents can contain macros (scripts). While there are legitimate uses for macros, bad actors can use them for malicious purposes.
Protected mode prevents the macros from running.
VitoRobles@lemmy.today · 8 pts · 340d
I'm so glad I don't work in industries like that.
Send me a doc file? In an email? Nah.
Just send me a webpage or PDF I can open in the browser. I'm not opening anything that requires downloading software.
onslaught545@lemmy.zip · 10 pts · 340d
Malicious PDFs are a thing.
snooggums@piefed.world · 4 pts · 340d
Also malicious web pages. You might need to do slightly more than opening the page, but with all the captcha and similar prompts people are click happy today.
Personally surprised there aren't more attacks that mimic the click to prove you aren't a robot and other captcha prompts.
muntedcrocodile@hilariouschaos.com · 0 pts · 340d
U still need to get someone to download or install something. The browser engine is incredibly locked down in terms of messing up ur system.
muntedcrocodile@hilariouschaos.com · 2 pts · 340d
When opened in a web browser not really. They can't jump the v8 engine and can't access remote services without explicit permission due to CORS.
SirActionSack@aussie.zone · 3 pts · 340d
"Here's the draft, please mark up and return." And it's a fucking PDF print of the word or excel doc.
Every damn week.
Track_Shovel@slrpnk.net · 2 pts · 340d
Wait you're the guy that actually opens shit on the web version of SharePoint? You fucking monster
udon@lemmy.world · 8 pts · 338d
I hope the EU sues the shit out of MS some time for this "feature". Write protection is one of the few things Libreoffice can't handle well, and from my perspective, that is the entire reason they have it. Also, funny enough, Office 362, their own fucking product, also can't handle it. So you need a computer where you can install the desktop version, just to untick the fucking "write-protected" box and do your job.
In academic research, you often have to apply for money from funding agencies, using write-protected templates. If you don't use the exact template or if it looks distorted in some way, you're out (of consideration for the funding, and long-term out of your job).
laserm@lemmy.world · 6 pts · 339d
Well before it people were getting hacked by VBS macros so yeah it makes sense..
TroublesomeTalker@feddit.uk · 2 pts · 339d
More profitable to sell the disease and the cure!
Honytawk@lemmy.zip · 2 pts · 339d
Yeah, better to gut Excel from usefull features because they can be abused /s
Randelung@lemmy.world · 4 pts · 340d
But it will just close and reopen and act like nothing happened, except your work is gone. Just switching meeting room? Well, who does that!?
TomMasz@lemmy.world · 3 pts · 340d
Is it ribbed for her pleasure?
rustydrd@sh.itjust.works · 2 pts · 340d
On the Turning completeness of Microsoft Powerpoint