Slashdot Mirror
After Decades of Abuse, Microsoft Adds an Anti-Macro-Malware Feature To Office (softpedia.com)
An anonymous reader writes: Microsoft is finally addressing the elephant in the room in terms of security for Office users and has announced a new feature in the Office 2016 suite that will make it harder for attackers to exploit macro malware. Sysadmins can now use group policies to disable the execution of macro scripts that retrieve content off the Internet, a tactic used by malware developers to trick users into allowing the download & automatic installation of malware on their PCs. "Macro malware" as this category is known, is the preferred method of distribution for most malware these days, especially ransomware.
It's sad that we actually need them to provide this, but users are idiots. Users click buttons. Users click "agree". Users click "run macro" users ignore "this could be dangerous". Lets go a step further and just straight up remove macros completely. There is no need for macro support, no one actually uses these features other than malware. Get rid of it.
(1) Home and student users are immune to macro viruses, or
(2) Microsoft is only worried about the security of its' corporate clients. . .
I don't understand this scenario. Can you explain? From where is this embedded executable retrieved? if it's inside the Word document itself, then it's the antivirus' problem to scan it and detect it. Isn't it?
Go away!
and only via group policy?
when it could be an easily added in-application option (AND the default setting.. with group policy permissions to disable changing), for ALL versions.
I always wondered why there is no distinction between macros that only modify the document in which they are embedded, and all other macros. Say, for instance a letter template that, upon instantiation, sets today's date, then removes all macros from the document.
There is no substitute for common sense. Especially, no body of rules will do.
Yes and no, the format is sufficiently opaque that it's difficult to scan for embedded files, and you could always embed something benign (eg a copy of wget) and call it with appropriate arguments to download additional malicious payloads.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Manufacturing industry: Government says "Your product is dangerous. Come up with a fix and issue a recall at your expense to implement your fix in every product out there that you sold."
Toy industry: Government says "Your product is dangerous. Pull it off the market. Have the people who bought it return it, and give them their money back."
Software industry: "Our product is dangerous. I know! Let's fix it, but only put the fix in our latest version to force people to upgrade and pay us more money." Government says "Great! We'd like to buy a million copies of the new version."
Given Microsoft's history with free security updates, I thought they understood the difference between a bug fix and a feature upgrade. But between this and rolling out unwanted adware and spyware as "important updates" I guess not.
It's sad that we actually need them to provide this, but users are idiots. Users click buttons. Users click "agree". Users click "run macro" users ignore "this could be dangerous".
All true but that also indicates that the system is stupidly designed. Software companies have conditioned them to ignore warning messages and EULAs and pop up buttons. Users are concerned with getting their task done and asking them to worry about the security of the system is dooming the system to failure right from the start. Any developer that thinks my technologically naive mother is going to be able to deal with macro malware is an idiot.
There is no need for macro support, no one actually uses these features other than malware.
That's straight up false. There are some groups that HEAVILY use macros. The financial industry in particular uses the crap out of them in Excel. (save the snark - it works for them) What should probably happen is that user defined macros should be disabled by default for most users. And no they should be possible to enable via a pop up. I almost never use macros so I'd be happy to have a way to disable them quasi-permanently. They're little more than a malware vector for me but that doesn't mean they aren't useful to other people.
I have never understood why macros need access to the Internet or to run an external program. Personally, I would rather be prompted if a macros needs to connect outside of the document. It would make more sense to me than telling me that a document is scary simply because I emailed it to my self via gmail,
This is typical of Microsoft. They introduce "features" which sound really cool, but in actual practice are ill-advised. Then they introduce band-aid solutions that are supposed to make up for these deficiencies, but really don't do anything except get in the way of normal usage, and insult the intelligence of users. The issue with Office macros has been around for about 20 years, and they have been attempting to fix the security holes ever since, to no effect. This is why Windows is such a sieve when it comes to security, because they've designed Windows with the same philosophy as all of their other products, including Office.
Now we have a reason to upgrade to a new version of Office!
[/sarcasm]
I HATE Office, ever since they switched to that damn ribbon bar. It killed my productivity, I now have to stop and think to remember how to click and waddle through what ribbon to get the options that I needed, where they were a fairly short menu dive before that I could frequently execute without touching the mouse.
When you sympathize with stupidity, you start thinking like an idiot.
Marcus Ranum said something like (paraphrase) "Security is only as good as it has to be" MS is only addressing this since it has to, just like when it finally disabled macro access to send email and read Outlook contacts after years of email worms. The bad guys will move on to the next poorly secured feature, and when it gets bad enough MS will then fix that. It's the cycle of life.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Once upon a time macros were quick, dirty, and useful. They didn't have or need access to anything outside the application. Then MS switched it all to VB crud and they were no longer quick and dirty, and hence rarely useful. Surely someone uses them for good, but I haven't met them.
So if sysadmins can set this via GPO, basically MS is doing their usual bullshit and assuming all people are running Windows in corporate environments to use Office and Exchange?
And how will this help the rest of us? Microsoft hasn't fixed anything, they've allowed corporate environments to turn off some functionality without really addressing the actual underlying problem -- their tendency to run everything silently without stopping to realize how that's a terrible idea.
But, that's OK ... I don't see much value in Office for personal use anyway, and except for the OS, Notepad and Calculator, I don't think I rely on any of Microsoft's stuff for anything anyway.
It just amazes me how much they continue to embody the cluelessness embodies in those "I'm a PC/I'm a Mac" commercials ... keep it up guys, keep believing the world runs on spreadsheets and Exchange.
Lost at C:>. Found at C.
You can disable them via a setting for anything except trusted locations, and manage this setting via GPO also.
So what? They should be off by default and require users to enable them to be utilized. 99% of users will never need macros and the few who do will be able to figure out how to enable them. In the mean time it's a huge security hole which costs millions of dollars to deal with every year. As with many things it should be opt-in not opt-out.
"Copy", "cut", and "paste" can be nouns, sure, but I doubt anyone thinks of the so-named icons as representing anything other than verbs.
Or how about "Back", "forward", "reload", ...?
Il n'y a pas de Planet B.
at an Office Depot, threatening to throw himself into a paper shredder. He's taking the news very badly.
Microsoft needs to take this one step farther. It would be extremely easy to create a macro that would write a file locally (for example, in JavaScript) that would, in turn, retrieve data from the Internet. So simply to keep the macro from accessing the Internet is not quite enough.
For your security, this post has been encrypted with ROT-13, twice.
at an Office Depot, threatening to throw himself into a paper shredder. He's taking the news very badly.
And standing in front of him was a long-time Office user, getting his revenge:
"I see you're trying to kill yourself. Would you like help with that?"
For your security, this post has been encrypted with ROT-13, twice.
Macros are dangerous.
Or worse..
Considered Harmful.
Wouldn't it be something if Microsoft made a Clippy in the form of a small Dijkstra depiction? They could use this Office Edsissent to help the user pick the shortest path when wading through widgets, ribbons, and wizards. And it would readily provide basic Clippy functionality, snidely deriding the user when it finds any error in correctness.
Would be enough to make me leave vim.
I took that to mean you were not aware the option existed. Apologies for misunderstanding.
No worries. Perhaps I was unclear. I am aware that there are ways to limit their use but they are needlessly arcane and should be enabled by default. Basically I'm trying to say that it should be relatively difficult to unintentionally turn on the ability to run macros. Most people (self included) rarely need the feature and it's nothing but a big security hole for them.
Can anyone clarify an apparent ambiguity (or error?) in the article referenced by the link in the original post? The article describes preventing Word macros from accessing Internet content, but the group policy shown in the screenshot is "Block macros from running in Office files from the Internet." That's not the same thing at all. Microsoft's suggestion to work around issues with the policy, quoted in the article, is to "ensure the file’s original location is considered trusted within the organization." That doesn't have anything to do with whether or not the macro accesses Internet content. Thanks.
The 1% of people who actually have or need Office 2016, that is!
My copy of Office 2007 is still doing fine, and honestly, I liked 2003 better.