11 ms·

"why the heck does Excel support embedded Flash is a great question" Gratuitously enabling embedding stuff like this in applications which don't really need it

by Luyt 15y ago

"why the heck does Excel support embedded Flash is a great question" Gratuitously enabling embedding stuff like this in applications which don't really need it makes me always shudder when some software vendor is touting buzzwords like 'rich content' and 'rich user experience'. Most of the times it means unnecessary bloat, and as we can see from this example, a security hole too.

gaius 15y ago
Presumably because the Flash widget is OLE? You might as well ask why "enable" Flash over HTTP. The answer is of course that no-one "enables" anything, you write something generic like OLE or HTTP and people just use it for whatever they want to do.
- nikcub 15y ago
  It is ActiveX. When you install Flash, it registers itself as an ActiveX object. If you run through your registry, you would probably be shocked to see all the different libraries that have been registered. To Microsoft's credit, running embedded ActiveX objects in Office is switched off by default. In large enterprise networks this can be set as part of a group policy. EMC must have switched it on. There is no granularity to it where you can say 'enable activex for video files but not for flash', so it is all or nothing. What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet (a great feature which is rarely used). The reason why they attacked with an ActiveX exploit in an office document instead of a web page is because the office documents allow you to embed the entire object so that it is loaded locally - but newer Windows will still know that the original source is from the web, so it will treat it as such. EMC must have had liberal group policies. But you see the situation often - sales guys receive powerpoint presentations with embedded objects, or are creating them, and need it enabled. You can review the various objects you have registered in windows by going to HKEY_CLASSES_ROOT\CLSID in your registry, or using a tool such as: http://www.nirsoft.net/utils/axhelper.html http://www.nirsoft.net/utils/axhelper.html To change your Office security settings, see this msft article: http://office.microsoft.com/en-us/word-help/enable-or-disable-activex-controls-in-office-documents-HA010031067.aspx http://office.microsoft.com/en-us/word-help/enable-or-disabl... Edit: just to add, OLE is just the old ActiveX. OLE on COM was very difficult to implement - so Microsoft stripped it down, simplified it and called the new set of interfaces ActiveX.
  - 4ad 15y ago
    > What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet [...] newer Windows will still know that the original source is from the web, so it will treat it as such. I think Windows uses alternate data streams to mark files as coming from the web, if the web server is Unix it can't, and will not do such a thing. Files will apear as coming from the intranet.
    - lmz 15y ago
      > I think Windows uses alternate data streams to mark files as coming from the web, if the web server is Unix it can't, and will not do such a thing. Doesn't that depend on the e-mail client / browser rather than the server? The client will mark the file as downloaded from the internet when downloading it. The data in the HTTP protocol is not altered.
- 4ad 15y ago
  Well OLE (and ActiveX) was a terrible idea. /edit: to the guys downvoting, does anyone really think running arbitrary, unknown code is a good idea?
  - wnight 15y ago
    Once you've got sandboxing it seems only logical, until then it's madness.
  - nikcub 15y ago
    I loved it when it first came out. We built some really nice applications using ActiveX. The problem was when they enabled it in IE without thinking through the implications. IIRC, by default, only intranet apps would be allowed to run ActiveX controls that were signed. Internet apps would prompt a warning - but as we all know now, users just clicked through them and enabled them to run. ActiveX itself is very nice and very simple - it is, after all, just a documented interface for components. It allowed us to port all those enterprise desktop apps into the browser. We had very efficient and fast web applications running in the browser long before the ajax revolution that came some years later. It completely changed the cost of IT and administration for a large number of businesses - you no longer had to maintain all these different custom-built desktop applications for every business unit - you just pointed their browser to the web app (we all know these advantages today, but back then it was completely revolutionary). You couldn't do it with just HTML then, you can now thanks for the new input types, xmlhttprequest (from Microsoft) etc.
Garbage 15y ago
[offtopic] But, Flash games inside excel has given immense pleasure to the employees where Flash games are not allowed directly. [/offtopic]
nhebb 15y ago
That question actually made me question the technical competence of F-Secure. You would think an anti-virus company would be more knowledgeable about embedded objects in Office documents.
- gvb 15y ago
  Someone at EMC ran it, not F-Secure - F-Secure found the email in their submitted virus sample inventory, i.e. someone at EMC uploaded it to F-Secure as a sample.
  - nhebb 15y ago
    As far as I can tell, the statement "why the heck does Excel support embedded Flash is a great question" was made by the F-Secure blogger. Microsoft Office applications have a long history of allowing embedded OLE/ActiveX objects. There are a bunch of companies that sell Flash dashboard tools for Excel. While I'm not a fan of Flash dashboards, the question just gave me the impression that the author doesn't have a good understanding of the environment that their anti-virus products are trying to protect.
    - uxp 15y ago
      It was a rhetorical question. I'm sure most of their researchers know why it is enabled (because the registry is marked blah blah). They were asking why did Microsoft decide that users should be capable of embedding executables inside a document format that inherently cannot have executable code stuffed inside it and frankly does not need executable code stuffed inside it.

by Luyt 15y ago

gaius 15y ago

Presumably because the Flash widget is OLE? You might as well ask why "enable" Flash over HTTP. The answer is of course that no-one "enables" anything, you write something generic like OLE or HTTP and people just use it for whatever they want to do.

nikcub 15y ago
It is ActiveX. When you install Flash, it registers itself as an ActiveX object. If you run through your registry, you would probably be shocked to see all the different libraries that have been registered. To Microsoft's credit, running embedded ActiveX objects in Office is switched off by default. In large enterprise networks this can be set as part of a group policy. EMC must have switched it on. There is no granularity to it where you can say 'enable activex for video files but not for flash', so it is all or nothing. What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet (a great feature which is rarely used). The reason why they attacked with an ActiveX exploit in an office document instead of a web page is because the office documents allow you to embed the entire object so that it is loaded locally - but newer Windows will still know that the original source is from the web, so it will treat it as such. EMC must have had liberal group policies. But you see the situation often - sales guys receive powerpoint presentations with embedded objects, or are creating them, and need it enabled. You can review the various objects you have registered in windows by going to HKEY_CLASSES_ROOT\CLSID in your registry, or using a tool such as: http://www.nirsoft.net/utils/axhelper.html http://www.nirsoft.net/utils/axhelper.html To change your Office security settings, see this msft article: http://office.microsoft.com/en-us/word-help/enable-or-disable-activex-controls-in-office-documents-HA010031067.aspx http://office.microsoft.com/en-us/word-help/enable-or-disabl... Edit: just to add, OLE is just the old ActiveX. OLE on COM was very difficult to implement - so Microsoft stripped it down, simplified it and called the new set of interfaces ActiveX.
- 4ad 15y ago
  > What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet [...] newer Windows will still know that the original source is from the web, so it will treat it as such. I think Windows uses alternate data streams to mark files as coming from the web, if the web server is Unix it can't, and will not do such a thing. Files will apear as coming from the intranet.
  - lmz 15y ago
    > I think Windows uses alternate data streams to mark files as coming from the web, if the web server is Unix it can't, and will not do such a thing. Doesn't that depend on the e-mail client / browser rather than the server? The client will mark the file as downloaded from the internet when downloading it. The data in the HTTP protocol is not altered.
4ad 15y ago
Well OLE (and ActiveX) was a terrible idea. /edit: to the guys downvoting, does anyone really think running arbitrary, unknown code is a good idea?
- wnight 15y ago
  Once you've got sandboxing it seems only logical, until then it's madness.
- nikcub 15y ago
  I loved it when it first came out. We built some really nice applications using ActiveX. The problem was when they enabled it in IE without thinking through the implications. IIRC, by default, only intranet apps would be allowed to run ActiveX controls that were signed. Internet apps would prompt a warning - but as we all know now, users just clicked through them and enabled them to run. ActiveX itself is very nice and very simple - it is, after all, just a documented interface for components. It allowed us to port all those enterprise desktop apps into the browser. We had very efficient and fast web applications running in the browser long before the ajax revolution that came some years later. It completely changed the cost of IT and administration for a large number of businesses - you no longer had to maintain all these different custom-built desktop applications for every business unit - you just pointed their browser to the web app (we all know these advantages today, but back then it was completely revolutionary). You couldn't do it with just HTML then, you can now thanks for the new input types, xmlhttprequest (from Microsoft) etc.

Garbage 15y ago

[offtopic] But, Flash games inside excel has given immense pleasure to the employees where Flash games are not allowed directly. [/offtopic]

nhebb 15y ago

That question actually made me question the technical competence of F-Secure. You would think an anti-virus company would be more knowledgeable about embedded objects in Office documents.

gvb 15y ago
Someone at EMC ran it, not F-Secure - F-Secure found the email in their submitted virus sample inventory, i.e. someone at EMC uploaded it to F-Secure as a sample.
- nhebb 15y ago
  As far as I can tell, the statement "why the heck does Excel support embedded Flash is a great question" was made by the F-Secure blogger. Microsoft Office applications have a long history of allowing embedded OLE/ActiveX objects. There are a bunch of companies that sell Flash dashboard tools for Excel. While I'm not a fan of Flash dashboards, the question just gave me the impression that the author doesn't have a good understanding of the environment that their anti-virus products are trying to protect.
  - uxp 15y ago
    It was a rhetorical question. I'm sure most of their researchers know why it is enabled (because the registry is marked blah blah). They were asking why did Microsoft decide that users should be capable of embedding executables inside a document format that inherently cannot have executable code stuffed inside it and frankly does not need executable code stuffed inside it.