Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Microsoft Security Software IT

After Decades of Abuse, Microsoft Adds an Anti-Macro-Malware Feature To Office (softpedia.com) 119

An anonymous reader writes: Microsoft is finally addressing the elephant in the room in terms of security for Office users and has announced a new feature in the Office 2016 suite that will make it harder for attackers to exploit macro malware. Sysadmins can now use group policies to disable the execution of macro scripts that retrieve content off the Internet, a tactic used by malware developers to trick users into allowing the download & automatic installation of malware on their PCs. "Macro malware" as this category is known, is the preferred method of distribution for most malware these days, especially ransomware.
This discussion has been archived. No new comments can be posted.

After Decades of Abuse, Microsoft Adds an Anti-Macro-Malware Feature To Office

Comments Filter:
  • Sadly needed (Score:2, Insightful)

    It's sad that we actually need them to provide this, but users are idiots. Users click buttons. Users click "agree". Users click "run macro" users ignore "this could be dangerous". Lets go a step further and just straight up remove macros completely. There is no need for macro support, no one actually uses these features other than malware. Get rid of it.
    • Re:Sadly needed (Score:4, Insightful)

      by Coisiche ( 2000870 ) on Wednesday March 23, 2016 @05:48AM (#51759641)

      There is no need for macro support, no one actually uses these features

      I've certainly never required one for Word but there have been several occasions where something I wanted to do in Excel could only be achieved by writing a macro. Oh sure, I perhaps *could* have managed without resorting to a macro but one instance I'd have probably still have been working on the task several years later... on the other hand maybe I wouldn't have been made redundant from that job if I hadn't tried to be efficient.

    • Re:Sadly needed (Score:5, Insightful)

      by Z00L00K ( 682162 ) on Wednesday March 23, 2016 @06:09AM (#51759695) Homepage

      And Microsoft has also made this possible by hiding the extension of files in the UIs making it a lot easier for evil people to trick stupid people into clicking on files that they think are images but actually are an executable.

      • The problem is if they are stupid, the extension showing probably wouldn't make a difference. I think technical people are more annoyed by that setting because they realize that even though something is an image it could be an executable or something else.
        • by Z00L00K ( 682162 )

          Even if it would make a difference to 10% it would be valuable. Hiding the extension is still extremely stupid, and when it's hidden it's necessary to do additional work to investigate the file to reveal if it is dangerous or not.

      • Except that in Macro Malware, this would actually make the problem worse. People might know not to click on executables and many "endpoint protection" packages will create a popup warning. Also Windows does a great job of tagging files as "downloaded from the internet" and requiring extra user confirmations before taking certain actions. But one thinks of an Excel file as data, not as code. People will open Excel select File/Open and then pick the XLSX with extension showing and get infected.
      • by Ed Avis ( 5917 )
        If Microsoft bothered to distinguish between 'opening' a file and 'running' a program - and double-click would only open, not run - then at least part of the problem would be fixed. But since the earliest days of Windows, the same verb 'Open' has been used for both operations. We can't blame users if they have been trained that double-clicking is the standard way to open a file (surely a safe operation in any sanely written system) but then the OS turns it into the much more dangerous operation of running
        • by hoggoth ( 414195 )

          Prepare for it to get a lot worse when we all have Turing-complete toothbrushes and our heart pace-makers can download ringtone-beat-patterns!

        • I disagree with your solution. Double click should only run, not open. You should run your word processor and then open a document with it. Allowing a document to open on double click means that some program is going to run, the user should have to explicitly select which one.
          --
          JimFive
      • I noticed this article was from the " fond-memories-of-weird-greenpeace-macro dept". And due to the hiding of extensions in the UI, I would be remiss to not remember the time that a general in the military confessed his undying love to me in an email ... with an email to follow about 20 minutes later telling us all to turn off our emails. ... Conspiracy theories abound...
    • by sjbe ( 173966 ) on Wednesday March 23, 2016 @06:49AM (#51759817)

      It's sad that we actually need them to provide this, but users are idiots. Users click buttons. Users click "agree". Users click "run macro" users ignore "this could be dangerous".

      All true but that also indicates that the system is stupidly designed. Software companies have conditioned them to ignore warning messages and EULAs and pop up buttons. Users are concerned with getting their task done and asking them to worry about the security of the system is dooming the system to failure right from the start. Any developer that thinks my technologically naive mother is going to be able to deal with macro malware is an idiot.

      There is no need for macro support, no one actually uses these features other than malware.

      That's straight up false. There are some groups that HEAVILY use macros. The financial industry in particular uses the crap out of them in Excel. (save the snark - it works for them) What should probably happen is that user defined macros should be disabled by default for most users. And no they should be possible to enable via a pop up. I almost never use macros so I'd be happy to have a way to disable them quasi-permanently. They're little more than a malware vector for me but that doesn't mean they aren't useful to other people.

      • by azcoyote ( 1101073 ) on Wednesday March 23, 2016 @08:00AM (#51760107)
        Yeah, as a professor I use macros a lot for common tasks in writing papers and for managing my gradebook. The main problem with macros is that they are so stupidly designed and VBA is such a stupid, inconsistent, and insecure language. Macros are already disabled by default until you enable them via a popup, but there is no distinction between harmless operations and dangerous ones that could compromise a user's system. I think Visual Basic needs to be replaced with another language, and macro security needs to be redesigned from the ground up. But Microsoft never does anything so sensible.
      • You can disable them via a setting for anything except trusted locations, and manage this setting via GPO also.
        • You can disable them via a setting for anything except trusted locations, and manage this setting via GPO also.

          So what? They should be off by default and require users to enable them to be utilized. 99% of users will never need macros and the few who do will be able to figure out how to enable them. In the mean time it's a huge security hole which costs millions of dollars to deal with every year. As with many things it should be opt-in not opt-out.

          • So when you said " I almost never use macros so I'd be happy to have a way to disable them quasi-permanently." I took that to mean you were not aware the option existed. Apologies for misunderstanding.
            • I took that to mean you were not aware the option existed. Apologies for misunderstanding.

              No worries. Perhaps I was unclear. I am aware that there are ways to limit their use but they are needlessly arcane and should be enabled by default. Basically I'm trying to say that it should be relatively difficult to unintentionally turn on the ability to run macros. Most people (self included) rarely need the feature and it's nothing but a big security hole for them.

              • Agree. I mentioned elsewhere it might make sense for MS to disable macros by default except maybe in enterprise editions. Or maybe even better, simply leave it to enterprise sysadmins to enable via GPO.
    • No one apart from all their people that do.

    • Why should users care? Not their computers and the IT guys problem.

      Most don't do that at home. But the IT guys can take the fall for ransomware for not securing them so why not? Some where I work laugh at us when they unplug and move shit and their supervisor blames us. It's funny.

      I believe 80% of users know better but do it anyway if it was from a client or boss ... Only at the office of course

    • Some use it and office automation is a big deal to some. What I do not understand is that an app macro engine has that easy access to the big knob of the OS. Other than saving files of specific types to designated and controlled areas an Office Suite needs no further resources aside from capturing keyboard and mouse entries and sending video data to the display driver. I think that the way Microsoft implemented macros, but also font handling and other functions is significantly flawed. The "fix" is the typi
  • by Salgak1 ( 20136 ) <<ten.ysaekaeps> <ta> <kaglas>> on Wednesday March 23, 2016 @05:41AM (#51759625) Homepage
    . . . no fixing extant versions of Office out there, and managing it by **GROUP POLICY**?? Really ? I guess that either:

    (1) Home and student users are immune to macro viruses, or

    (2) Microsoft is only worried about the security of its' corporate clients. . .

    • by Anonymous Coward

      You can apply policy templates to the local security policy. So yeah. .home people could also do this. ..although having a ui to manage this would work better in the home use case. (I haven't checked if there will be a preference ui update to match though)

      • by Salgak1 ( 20136 )
        And you expect home users to:

        1. Load MMC.

        2. Load up the Local Security Policy Plug-in

        3. Configure the appropriate Local Security Policy

        If Micro$loth were to release a one-click fix, MAYBE. But expecting the average Joe out there to correctly configure sysadmin tools is a bit of a stretch. . .

        • The current versions of Office allow users to globally disable macros with no popup to enable them. But of course this is rarely used since ignorant (just a description, not a condemnation) users don't want to break anything. Perhaps MS could disable macros completely by default for non-enterprise editions.
      • You can apply policy templates to the local security policy. So yeah. .home people could also do this. ..although having a ui to manage this would work better in the home use case. (I haven't checked if there will be a preference ui update to match though)

        I don't think any editions of Office 2016 apart from Professional Plus and up will read group policy. Most home users don't buy (rent?) those editions.

    • by Anonymous Coward
      Corporate is where the cash is. They probably had complaints for years and finally decided to do something about it when they saw firms switching to LibreOffice or OpenOffice.
    • Re: (Score:2, Insightful)

      by kaur ( 1948056 )
      Dear Microsoft.
      Please give us an example where a home user would benefit from the capability of Office documents to load anything from the web.
      Does this benefit outweight the risk it creates?
      How?

      In other words -
      DROP THIS BLOAT from your software, for all and for good.
      With the exception of corporate users who, in a strictly controlled environment, might use it - GPO allowing.
    • by Anonymous Coward

      . . . no fixing extant versions of Office out there, and managing it by **GROUP POLICY**?? Really ? I guess that either:

      (1) Home and student users are immune to macro viruses, or

      (2) Microsoft is only worried about the security of its' corporate clients. . .

      Microsoft is worried about the REVENUE from its' corporate clients.

      It should be painfully obvious that they really don't give a shit about security in and of itself.

    • by AmiMoJo ( 196126 ) <mojo.world3@net> on Wednesday March 23, 2016 @07:18AM (#51759915) Homepage

      The summary is full of shit. Macros have been disabled by default for a decade now. Seriously, Office 2007 on my work PC requires me to manually enable macros every time I open a document. That's the default setting.

      The only change seems to be that this policy can be altered and enforced by Group Policy.

      • by Anonymous Coward

        People click past these things. They have become conditioned to think that this is normal as they don't understand the full implications of saying yes.

      • The summary is full of shit. Macros have been disabled by default for a decade now. Seriously, Office 2007 on my work PC requires me to manually enable macros every time I open a document. That's the default setting.

        The only change seems to be that this policy can be altered and enforced by Group Policy.

        This is about blocking macros that connect to the Internet, not macros themselves. You are correct that macros have been disabled by default for documents that come from locations that are not marked in Office as "trusted," with a notification that allows you to enable them if desired. This is different, as it affects only a subset of macros and does not allow the user to un-block them. (Also, being able to control macro settings via Group Policy is not new.)

        This sounds like a good move to me. I can't recal

        • by AmiMoJo ( 196126 )

          Sure, but the way the summary presents it you would be forgiven for thinking that previous versions of Office just ran any old crap they found embedded in documents, and that certainly is not the case.

      • Macros have been disabled by default for a decade now.

        That's not the point of TFA or even TFS. The point is that different enable/disable policies can be implemented for macros that connect to the internet versus macros that operate in a sandbox such as buttons in an Excel spreadsheet that manipulate the data inside the spreadsheet. Right now, it's all or nothing.

        That said, I'd prefer that write access to local files is also restricted. It's fine if a macro can automatically import data from a file, but I'

    • Then they would complain their offices ain't working to MS and return their computers for ones that work.

      There already is a feature. It is called a warning in a yellow title bar.

      If the user is stupid enough that is on them. MS should not get in the way.

      However, these same users are careful at home. They are not stupid contrary to what is posted here. It is that they don't give a shit at work since they don't own them.

      Notice how the company cars always get trashed but not the workers personal cars?

      That's the

  • by Anonymous Coward

    and only via group policy?

    when it could be an easily added in-application option (AND the default setting.. with group policy permissions to disable changing), for ALL versions.

    • it could be an easily added in-application option (AND the default setting.. with group policy permissions to disable changing), for ALL versions.

      You think that updating, recompiling, testing and releasing 30+ versions of software released over the past 26 years is easy?

      ROFLMFAO

  • Exempt Safe Macros (Score:4, Interesting)

    by Cacadril ( 866218 ) on Wednesday March 23, 2016 @06:07AM (#51759693)
    I always wondered why there is no distinction between macros that only modify the document in which they are embedded, and all other macros. Say, for instance a letter template that, upon instantiation, sets today's date, then removes all macros from the document.
    • Sun tried this 20 years ago with Java and Oracle is still busy with failing to do it properly.

    • I always wondered why there is no distinction between macros that only modify the document in which they are embedded, and all other macros.

      Why are there other macros? It seems to me that macros should only be able to modify the document in which they are embedded. If you need something other than that, then you don't need a macro-- you need some kind of different application. Like if you're cobbling together some elaborate database application by having a series of macros that write different things to different Excel files or something, you should give it up and admit you need a database application.

      Let documents be documents. Opening a

    • Sounds like a halting problem to me.
      • Seriously? No. You could make a Lists of functions you want to Control Access to - lets call them ACLs for short - then assign them to roles. Role "received from someone else" might have an ACL like:

        • Allow edits to the current document
        • Deny all

        so that the macro could tear up its own home in all sorts of ways, but couldn't call functions like fetchFromRussiaExecuteAsAdmin(url).

    • The very act of a macro removing the macros from the document is at a high privilege level already, because it has the ability to modify the macros. A macro with the ability to modify a macro or save a file is already at the application layer and filesystem layer.

      Also, certain tools can be used at different privilege levels. I've used FileSystemObject to write CSVs out of the files directly (write/create), and I've also used it just to get a directory list (read). I mean, you could blacklist certain part

  • by Solandri ( 704621 ) on Wednesday March 23, 2016 @06:23AM (#51759733)
    Manufacturing industry: Government says "Your product is dangerous. Come up with a fix and issue a recall at your expense to implement your fix in every product out there that you sold."

    Toy industry: Government says "Your product is dangerous. Pull it off the market. Have the people who bought it return it, and give them their money back."

    Software industry: "Our product is dangerous. I know! Let's fix it, but only put the fix in our latest version to force people to upgrade and pay us more money." Government says "Great! We'd like to buy a million copies of the new version."

    Given Microsoft's history with free security updates, I thought they understood the difference between a bug fix and a feature upgrade. But between this and rolling out unwanted adware and spyware as "important updates" I guess not.
    • by wbr1 ( 2538558 )
      A counter argument to this is that software would then so expensive that it would be beyond the average persons ability to purchase.
  • Internet access? (Score:5, Insightful)

    by denbesten ( 63853 ) on Wednesday March 23, 2016 @07:11AM (#51759893)

    I have never understood why macros need access to the Internet or to run an external program. Personally, I would rather be prompted if a macros needs to connect outside of the document. It would make more sense to me than telling me that a document is scary simply because I emailed it to my self via gmail,

    • Re:Internet access? (Score:4, Interesting)

      by herve_masson ( 104332 ) on Wednesday March 23, 2016 @08:07AM (#51760155)

      Well, yes. This is called "sandboxing". Microsoft should have made their macro run in a sandbox, with prominent prompts when the marco needs to access the filesystem, send data over the network, run an external program etc etc Anything that is not manipulating data in the current document.

      But this is the the way microsoft dioes things, and it sucks hard.

      • Those prompts could even be as detailed as "this document wants to fetch and execute a program from an Internet site that's not in your company's domain and isn't in your browser history. It's also in North Korea. Do you want to allow this?" Dig and whois are right there, begging to be dug and whois'd.

    • I have never understood why macros need access to the Internet or to run an external program.

      A lot of these things started back before people expected malicious hackers. Early email systems didn't even have passwords. Even in the 90s, Mac OS and Windows didn't really have the ability to password protect the system. When Microsoft introduced Internet Explorer, Microsoft went through a lot of trouble to make sure that the web browser could access the filesystem and control the system, going as far as having their patching/updating mechanism run from a web page. We're still struggling with the eff

      • Basically, computer stuff engineered longer than 15 years ago was aimed at increasing the capabilities, without regard for security.

        You are wrong. Unix was engineered more than 40 years ago and it was built with security from the start.

        • I was speaking generally. Of course there were secure computing systems, but most of what you saw wasn't very secure. Even if the OS itself was secure, the apps and services running on them may not have been.
    • I have never understood why macros need access to the Internet or to run an external program. Personally, I would rather be prompted if a macros needs to connect outside of the document. It would make more sense to me than telling me that a document is scary simply because I emailed it to my self via gmail,

      I'll give you two examples of how macros are used in ways that involve external programs.

      The first is a program called Worldox. It's used heavily by law firms, and it allows users to "save to Worldox", to which you're saying, "so...they reinvented the file system?" Not exactly. Saving to Worldox allows a document to be assigned to a particular case, with a bunch of metadata pulled from the document, to allow it to be filed along with other documents relevant to the case. It also allows e-mail correspondence

  • by rcase5 ( 3781471 ) on Wednesday March 23, 2016 @07:26AM (#51759941)

    This is typical of Microsoft. They introduce "features" which sound really cool, but in actual practice are ill-advised. Then they introduce band-aid solutions that are supposed to make up for these deficiencies, but really don't do anything except get in the way of normal usage, and insult the intelligence of users. The issue with Office macros has been around for about 20 years, and they have been attempting to fix the security holes ever since, to no effect. This is why Windows is such a sieve when it comes to security, because they've designed Windows with the same philosophy as all of their other products, including Office.

    • The issue with Office macros has been around for about 20 years, and they have been attempting to fix the security holes ever since, to no effect.

      Critique is child's play, solutions are not.

      How would you fix it?

  • by wwphx ( 225607 ) on Wednesday March 23, 2016 @07:30AM (#51759953) Homepage
    Now we have a reason to upgrade to a new version of Office!

    [/sarcasm]

    I HATE Office, ever since they switched to that damn ribbon bar. It killed my productivity, I now have to stop and think to remember how to click and waddle through what ribbon to get the options that I needed, where they were a fairly short menu dive before that I could frequently execute without touching the mouse.
  • Marcus Ranum said something like (paraphrase) "Security is only as good as it has to be" MS is only addressing this since it has to, just like when it finally disabled macro access to send email and read Outlook contacts after years of email worms. The bad guys will move on to the next poorly secured feature, and when it gets bad enough MS will then fix that. It's the cycle of life.
  • Once upon a time macros were quick, dirty, and useful. They didn't have or need access to anything outside the application. Then MS switched it all to VB crud and they were no longer quick and dirty, and hence rarely useful. Surely someone uses them for good, but I haven't met them.
  • So if sysadmins can set this via GPO, basically MS is doing their usual bullshit and assuming all people are running Windows in corporate environments to use Office and Exchange?

    And how will this help the rest of us? Microsoft hasn't fixed anything, they've allowed corporate environments to turn off some functionality without really addressing the actual underlying problem -- their tendency to run everything silently without stopping to realize how that's a terrible idea.

    But, that's OK ... I don't see much

    • by ledow ( 319597 )

      GPOs generally do nothing more than apply local polices which generally do nothing more than force certain registry entries.

      If a GPO exists, it's because a registry entry that it can tweak exists. Generally, it takes no more than a Google or a dig through an admx file to find out the registry entry that they correspond to.

      Slashdot comment system will munge it but open any ADMX and you see this:

      ANGLE BRACKET policy name="L_Underlinehyperlinks" class="User" displayName="$(string.L_Underlinehyperlinks)" expla

      • by Shoten ( 260439 )

        GPOs generally do nothing more than apply local polices which generally do nothing more than force certain registry entries.

        If a GPO exists, it's because a registry entry that it can tweak exists. Generally, it takes no more than a Google or a dig through an admx file to find out the registry entry that they correspond to.

        Slashdot comment system will munge it but open any ADMX and you see this:

        ANGLE BRACKET policy name="L_Underlinehyperlinks" class="User" displayName="$(string.L_Underlinehyperlinks)" explainText="$(string.L_UnderlinehyperlinksExplain)" key="Software\Policies\Microsoft\Office\12.0\Access\Internet" valueName="DoNotUnderlineHyperlinks" ANGLE BRACKET

        There's an important distinction here, though...it has to do with who applies the local policy that generally does nothing more than force certain registry entries. Those parts of the registry can be locked down such that nothing that runs in the context of the human user at the system can change them, even though the machine account that enforces GPOs can. You can even take this so far as to preserve most administrator-level rights so that the end-user can still run shitty software or install the latest

      • Sure, but my point is for the average person who could get screwed by this vulnerability, this does no good at all.

        My mother-in-law isn't going to google for what registry key needs to be put in to solve a problem she doesn't understand.

        If the best Microsoft can do to fix this problem is a half-assed fix which is only applicable to corporate controlled networks or advanced users, it completely misses all of those other people who don't have this and are more likely to be vulnerable.

        This isn't a solution, it

  • at an Office Depot, threatening to throw himself into a paper shredder. He's taking the news very badly.
    • by Shoten ( 260439 )

      at an Office Depot, threatening to throw himself into a paper shredder. He's taking the news very badly.

      And standing in front of him was a long-time Office user, getting his revenge:

      "I see you're trying to kill yourself. Would you like help with that?"

  • Microsoft needs to take this one step farther. It would be extremely easy to create a macro that would write a file locally (for example, in JavaScript) that would, in turn, retrieve data from the Internet. So simply to keep the macro from accessing the Internet is not quite enough.

  • Can anyone clarify an apparent ambiguity (or error?) in the article referenced by the link in the original post? The article describes preventing Word macros from accessing Internet content, but the group policy shown in the screenshot is "Block macros from running in Office files from the Internet." That's not the same thing at all. Microsoft's suggestion to work around issues with the policy, quoted in the article, is to "ensure the file’s original location is considered trusted within the organi
  • The 1% of people who actually have or need Office 2016, that is!

    My copy of Office 2007 is still doing fine, and honestly, I liked 2003 better.

Line Printer paper is strongest at the perforations.

Working...