Slashdot Mirror
After Decades of Abuse, Microsoft Adds an Anti-Macro-Malware Feature To Office (softpedia.com)
An anonymous reader writes: Microsoft is finally addressing the elephant in the room in terms of security for Office users and has announced a new feature in the Office 2016 suite that will make it harder for attackers to exploit macro malware. Sysadmins can now use group policies to disable the execution of macro scripts that retrieve content off the Internet, a tactic used by malware developers to trick users into allowing the download & automatic installation of malware on their PCs. "Macro malware" as this category is known, is the preferred method of distribution for most malware these days, especially ransomware.
I always wondered why there is no distinction between macros that only modify the document in which they are embedded, and all other macros. Say, for instance a letter template that, upon instantiation, sets today's date, then removes all macros from the document.
There is no substitute for common sense. Especially, no body of rules will do.
Well, yes. This is called "sandboxing". Microsoft should have made their macro run in a sandbox, with prominent prompts when the marco needs to access the filesystem, send data over the network, run an external program etc etc Anything that is not manipulating data in the current document.
But this is the the way microsoft dioes things, and it sucks hard.