4 ms·

If you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.

by zelon88 7y ago

arthurcolle 7y ago
Haha really? That is hilariously insecure.
- zozbot234 7y ago
  I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.
  - kevindqc 7y ago
    Makes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password
    - arthurcolle 7y ago
      I guess in any case, if you really care about security, you could just encrypt the file separately and only send someone the encrypted binary.
  - NullPrefix 7y ago
    The Torx screw of presentations.
- gruez 7y ago
  But then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.
ChrisSD 7y ago
Warning: This being true, it can still be construed as "hacking" no matter how simple it is. Just because the barrier is easy to get over, it doesn't mean you're legally allowed to enter. This person asserted the spreadsheet was his "work product". Presumably Siemens's lawyers found this convincing enough to be wary of hacking around the password.
- zelon88 7y ago
  I have a different view. Considering the company employed "Person A" to create a spreadsheet, why would it be a violation to employ "Person B" to gain access to it in the absence of "Person A"? The company owns all of the technology and employs all of the personnel involved, no?
  - NullPrefix 7y ago
    Wasn't he a consultant, not an employee?
  - ska 7y ago
    > company owns all of the technology and employs all of the personnel involved, no? No, he's a contractor. So what they own precisely should have been defined in the consulting contract. It may have been perfectly legal for him to password protect the output, much like using an obsfucator - but the time-bomb stuff is fraud any way you cut it.
ealfert 7y ago
Nice tip! I found the following screenshots/guide that shows "sheetProtection" includes "algorithmName" and "hashValue" but not "password" variable... https://www.excelsupersite.com/how-to-remove-an-excel-spreadsheet-password-in-6-easy-steps/ https://www.excelsupersite.com/how-to-remove-an-excel-spread...
jlgaddis 7y ago
About 30 years ago, when I was just a kid, my parents would make me go with them when they went shopping. I would always go wander around the electronics section of the store (I'm thinking of Walmart, specifically) to play with the computers. At that time, Windows 3.1 was the latest and greatest and is what was running on all of the "display" PCs. Unfortunately, the password-protected screensaver was almost always activated -- meaning you couldn't actually do anything on the PCs. Luckily, those passwords were easily bypassed! All you needed to do was simply power cycle / reboot the machine. Once it started booting up, you would just hit CTRL-C to interrupt and terminate the "autoexec.bat" file. Next, change into the "\WINDOWS\" directory, and open up some .INI file [0], find the line where the password was set, and delete everything after the "=" sign. Finally, save your changes, exit the editor, and hit CTRL-ALT-DEL to reboot. The PC would start up and launch into Windows as usual, but without any password protection for the screensaver. (A slightly older version of myself may have, allegedly, then set his own passwords on occasion.) [0]: "sys.ini", "windows.ini", something like that.
- schoen 7y ago
  My recollection is that you can also stop AUTOEXEC.BAT from running by holding the shift key.

If you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.

arthurcolle 7y ago

Haha really? That is hilariously insecure.

zozbot234 7y ago
I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.
- kevindqc 7y ago
  Makes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password
  - arthurcolle 7y ago
    I guess in any case, if you really care about security, you could just encrypt the file separately and only send someone the encrypted binary.
- NullPrefix 7y ago
  The Torx screw of presentations.
gruez 7y ago
But then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.

ChrisSD 7y ago

Warning: This being true, it can still be construed as "hacking" no matter how simple it is. Just because the barrier is easy to get over, it doesn't mean you're legally allowed to enter. This person asserted the spreadsheet was his "work product". Presumably Siemens's lawyers found this convincing enough to be wary of hacking around the password.

zelon88 7y ago
I have a different view. Considering the company employed "Person A" to create a spreadsheet, why would it be a violation to employ "Person B" to gain access to it in the absence of "Person A"? The company owns all of the technology and employs all of the personnel involved, no?
- NullPrefix 7y ago
  Wasn't he a consultant, not an employee?
- ska 7y ago
  > company owns all of the technology and employs all of the personnel involved, no? No, he's a contractor. So what they own precisely should have been defined in the consulting contract. It may have been perfectly legal for him to password protect the output, much like using an obsfucator - but the time-bomb stuff is fraud any way you cut it.

ealfert 7y ago

Nice tip! I found the following screenshots/guide that shows "sheetProtection" includes "algorithmName" and "hashValue" but not "password" variable... https://www.excelsupersite.com/how-to-remove-an-excel-spreadsheet-password-in-6-easy-steps/ https://www.excelsupersite.com/how-to-remove-an-excel-spread...

jlgaddis 7y ago

About 30 years ago, when I was just a kid, my parents would make me go with them when they went shopping. I would always go wander around the electronics section of the store (I'm thinking of Walmart, specifically) to play with the computers. At that time, Windows 3.1 was the latest and greatest and is what was running on all of the "display" PCs. Unfortunately, the password-protected screensaver was almost always activated -- meaning you couldn't actually do anything on the PCs. Luckily, those passwords were easily bypassed! All you needed to do was simply power cycle / reboot the machine. Once it started booting up, you would just hit CTRL-C to interrupt and terminate the "autoexec.bat" file. Next, change into the "\WINDOWS\" directory, and open up some .INI file [0], find the line where the password was set, and delete everything after the "=" sign. Finally, save your changes, exit the editor, and hit CTRL-ALT-DEL to reboot. The PC would start up and launch into Windows as usual, but without any password protection for the screensaver. (A slightly older version of myself may have, allegedly, then set his own passwords on occasion.) [0]: "sys.ini", "windows.ini", something like that.

schoen 7y ago
My recollection is that you can also stop AUTOEXEC.BAT from running by holding the shift key.