Slashdot Mirror
How a Bad UI Decision From Microsoft Helped Macro Malware Make a Comeback (softpedia.com)
An anonymous reader writes: Macro malware is a term to describe malware that relies on automatically executed macro scripts inside Office documents. This type of malware was very popular in the '90s, but when Microsoft launched Office 97, it added a popup before opening Office files that warned users about the dangers of enabling macros. Microsoft's decision had a huge impact on macro malware, and by the 2000s, this type of malware went almost extinct. Lo and behold, some smart Microsoft UI designers start thinking that users might get popup fatigue, so in Office 2007, Microsoft makes the monumental mistake of removing the very informative popup, and transforming the warning into a notification bar at the top of the document with only six words warning users about macros. Things get worse in Office 2010, when Microsoft even adds a shiny button that reads "Enable Content," ruining everything it had done in the past 10-15 years, and allowing macro malware to become the dangerous threat it is today. The U.S.-CERT team issued an official threat yesterday warning organizations about the resurging threat of malware that uses macro scripts in Office documents.
You have to be retarded to click on "Run Content" if you don't trust the source..,.
People are, and will be idiots, what is new?... ...and what do you propose as solution?
Removing macros? Further dumbing down systems ala Apple?
Fuck. That. Shit.
And what are the good UI decisions Microsoft ever made? Remember the "Start" button debacle?
The one takeaway I had from reading the CERT article here: https://insights.sei.cmu.edu/c... is that the bad UI design decisions affect more than just the macros.
They should revert Outlook's behavior too. Clicking on an email should automatically launch any associated attachments. I get user fatigue opening all these strange invoices that keep coming in from Russia!
Did you forget to take your meds again, grandpa?
This is rooted in Microsoft culture. Security is never a primary concern. Imagine someone with a whiny voice saying "It's too hard, I don't wanna do it, it makes things no fun" etc, etc. From the outside that seems like how they behave.
And there is the little matter of loss of institutional memory, which is the senility part. That is because they consciously exclude people of long experience. They don't hire them, and if anyone is too long on the job they get flushed out. It's cheaper and keeps the workforce docile. But the long term result is making the same mistake over and over again. Not that Microsoft is a whole lot worse then any other big software organization, but they appear to do it even more then other big outfits.
Expect them to resurrect the BSOD any day now...
Why is Snark Required?
MS makes UI decisions? I thought they just delegated UI coding to the new hires, saying "Here's a project for you to learn coding on."
Ya those macros are really terrible. I hate automating complex and repetitive calcs in xcel. I really hate all the science that macros have facilitated.
Yup, macros are evil.
What kind of lobotomised twats do they have writing over there at softpedia. And why should I give a shit what they say? Been in the business over 20 years, never head of them. After having read this summary, I think I will never visit their site.
You can only warn but you can't prevent stupid. It's not like the code gets executed right away. You have to PURPOSELY enable it. This is no different when people install whatever off the internet because they don't know better, while running an expired virus scanner that came with their computer when they bought it back in 2011. While I understand that Microsoft is a very user friendly OS compared to something like Linux, you can really only do so much without making it TOO user friendly where you can't do anything.
I wondered why I've been hearing about macros malware again! Granted, I haven't used office in a looong time. But I thought, wasn't that solved in like 1993... don't allow macros? Guess history does repeat itself.
Defenses to threats that are not exploited become de-prioritized over time, especially when an "almost extinct" vector is the threat and you are asking hundreds of millions of people to click an extra dialog that they don't understand to begin with.
It's like smallpox. It is basically eradicated, but if it comes back we'll have an issue because we're not strict about vaccinating for it, because it's basically extinct.
Real lawyers write in C++
> and what do you propose as solution?
> Removing macros? Further dumbing down systems ?
The problem is that Microsoft dumbed it too much. They have one button where they should have two. The ONLY option is the new UI is "Run Content". There should be a "No Thanks" button.
As explained in the fine summary, the recommendation is something like the old warning, which actually worked, or least an option labeled "dismiss", "cancel", or "disable macros". Here's one MS UI that worked:
http://i1-news.softpedia-stati...
Microsoft traded that for a single button with the instruction "Enable Content". There is no more "disable macros" option anymore. Anyone who isn't sure what they should do will often click the one and only option Microsoft provides: run the macros. There should be a button to dismiss the message without running macros.
Well, that's one way of looking at it. The other is that Microsoft had to cater to the lowest common denominator with big scary warning dialogs when you did something potentially stupid. And that they did that because it was new and people were ignorant, but that as a computer literate generation grew up they thought they could start taking off the training wheels. I mean, it's not like Linux gives you much warning when you break shit, yeah you might have to invoke sudo but that is the universal "trust me, I know what I'm doing" code word. And of course you'll take the shit in the forums if you don't know what you're doing, but reality is people use computers despite that. Personally I think the current button is fine, I need a choice not a lecture.
Live today, because you never know what tomorrow brings
The trouble is that the inadequate security design of MS Windows gets blamed on the users. The real trouble is that MS Windows doesn't have adequate access control and allows any program to do anything and erase or overwrite anything.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
I notice that if you accidentally install Windows 10 by mis-answering the OS prompt, you get the proper Office prompt.
I'm too lazy for MS's shenanigans. I just enable macros by default in outlook to run an auto-bcc vba script without being bothered all the time.
Linux has the same problem.
A limited user (even without sudo rights) launches a buggy application and opens an infected document. The virus can then proceed to encrypt all the files that the user can modify.
The system files will stay intact.
The documents of the user will get encrypted.
The user usually cares about being able to access his documents, so the damage is done even without root access. If this happens on a single user desktop, then the damage is the same as if the virus had root access. In both cases you have to restore the PC from backups (if you have them).
...was when they decided that hiding the extension was a great idea and made it default in XP.
trojan.jpg.zip anyone?
MS Office peaked in 2002, and that's the version I'm still using. The Office UI has been an amazing series of increasingly idiotic disastrous design decisions, culminating in the current situation where one must navigate through three different screens to save a file. And I'm not talking about saving to a new location, I'm talking about versioning the currently open file into the same location. It's just idiotic, it's as if they are trying to sabotage productivity.
How is there news about Office 2010, which was presumably released 6 years ago. Who even uses Office these days, Google docs all the way... or a Markdown editor.
In order to protect users from malicious scripts and spreadsheets that insult religion, the next version of Excel will not execute any scripts or formulae not cryptographically signed with MS's key. A developer license will only be $99 a year and all reviews are conducted expeditiously, usually less than a week.
Not if SELinux or AppArmor is enabled
I generally don't blame Microsoft when this problem resulted probably from so many users complaining they had no easy way to run it. So Microsoft brought it back. But as someone else noted, here it is 2016 and were talking about Office 2010? Slow news day?
The real issue here is that macros and scripts should always run in a very well designed and hardened sandbox. No matter what your script does, it won't be able to do more than screwing up the spreadsheet it came embedded with. It really is insane that a macro could harm your computer, except in Microsoft's world.
The culprit is simply bad design. Nobody in their right mind would allow arbitrary scripts from unknown sources to be run freely in an environment where they can affect things outside that environment.
See subject: Office compound documents (OLE) won't execute macros if you hold the SHIFT key down as you open them - stops macros running automatically.
APK
P.S.=> Or does THAT not work anymore too? Last I knew of, it did from the very 1st 16-bit versions of Office, into the 32-bit models like Office 2003 (I think that was the name of the last model I used regularly @ home)... apk
Seriously, what kind of head injuries do the people at Microsoft have?? This is an enormously STUPID decision made by enormously STUPID people.
Ask technically-savvy people about this and 99.99999% would say, "Don't do this", but the wizards at MS in their infinite wisdom do it anyway?
WTF, Microsoft?? Do you want your users to be fucked over?
Just cruising through this digital world at 33 1/3 rpm...
Of course, we all know that in Windows, clicking the X on the right now means "go ahead and do it". :)
Somebody had to say it.
By attempting to ratchet up security they have interestingly reduced it. Now it seems that ever document from any source results in some sort of restriction that prevents printing, editing or doing anything else useful. Choices to deal with it often are limited to "trust" or not. I need to print stuff, I need to edit it, but I don't want to trust it! Why do I have to trust documents to print them?? I need to be able to easily disable potentially malicious macros while still retaining functionality.
Often times at work, one co-worker e-mails an Office document to another. The recipient opens the document from their e-mail, clicks the Enable button on that yellow notification bar to switch from read-only mode to editing mode, and then views the document without making any changes. Whenever I see this, I point out to the person that they should not click that button unless they're read what the notification says (click to enable editing), and they should only click it if they need (and know they need) what it enables.
Supposedly things are set up at work where macros can't run from the C: drive, which is where Outlook stores files opened from an e-mail, so many it won't be an issue if a document with a malicious macro comes in from the outside. Nonetheless, I'll continue my quest to try to get everyone to be just a little more careful about what they're enabling.
I think the worst decision was putting security functions in dynamically loaded libraries and allowing them to be dynamically hijacked
Did you forget to take your meds again, grandpa?
Being that stupid you are in grave danger, kid.
https://en.wikipedia.org/wiki/Edward_Snowden
Someone knew someone.
A limited user (even without sudo rights) launches a buggy application and opens an infected document.
What application would that be?
Linux bugs happens, and gets fixed quickly. The problem with ms office is not a 'chance bug', but a design bug. Meaning it is buggy as intended by people who possibly did not think this through. And therefore it won't be fixed at all until serious problems have reigned for some time. (Like the last time this happened.)
Eh. Why would that help anything?
Linux has the same problem.
A limited user (even without sudo rights) launches a buggy application and opens an infected document. The virus can then proceed to encrypt all the files that the user can modify.
The system files will stay intact.
The documents of the user will get encrypted.
The user usually cares about being able to access his documents, so the damage is done even without root access. If this happens on a single user desktop, then the damage is the same as if the virus had root access. In both cases you have to restore the PC from backups (if you have them).
Marked up 4, Interesting for what is total bullshit. Microsoft pays for stories here and people to bullshit the comments. The comments since day one of Slashdot are what anybody even cared about. You don't even read this shit for the stories, its the comments because it is tech-minded aka like-minded people. Well, it was. Until everybody bought into the Myspace then Facebook bullshit then Reddit etc.
Linux does not have the same problem. There are no "Macro Malware" problems in Linux dickhead. You can right now go download LibreOffice or LibreOffice portable and run it on Windows as well. If you are having malware problems it is literally because you are using Windows. Windows is not only malware now but also adware and most importantly spyware. How they pushed it on the public with sneak after sneak is the epitome of corporate liars.
Fuck Microsoft and fuck people sticking up for asshole companies. Linux's only real problem is systemd being pushed as if it is the new "registry" of Linux. One thing to control your whole operating system. You should also disable Akonadi and Nepomuk upon any install of desktop Linux in my opinion. They are the desktop search that doesn't want to go away when you want it to. It is thus far a small hassle to disable it in KDE preferences. Every where you turn somebody wants to control your PC and for what? Average Joe doesn't care about hacking his peers PC's it's the government infiltrating corporations like Microsoft and Google and of course Facebook.