3 ms·

I'm not sure what is really going on here. Macros have been disabled by default for many years now. Is this article from fifteen years ago?

pishpash 5y ago
I'm reading it as it being disabled beyond a confirmation modal. You probably have to change some file attribute to re-enable it, perhaps. Edit: Yep, from the linked article inside the article - "Once a user opens an attachment or downloads from the internet an untrusted Office file containing macros, a message bar displays a Security Risk that the file contains Visual Basic for Applications (VBA) macros obtained from the internet with a Learn More button. The Learn More button goes to an article for end users and information workers that contains information about the security risk of bad actors using macros, safe practices to prevent phishing & malware, and instructions on how to enable these macros by saving the file and removing the Mark of the Web (MOTW)."
caminante 5y ago
I'm perplexed too! How does this article reconcile with the existing disabled by default practice? > Security Warning Macros Have Been Disabled [enable content] At best, the headline is still misleading. Macros are already disabled. Clicking more "are you sure?" prompts is different and dubious
- gruez 5y ago
  >How does this article reconcile with the existing disabled by default practice? AFAIK it's usually combined with some sort of social engineering attack to get the user to bypass the warning. eg. "this document is password protected by Adobe Protect™ to view document, click enable macros".
  - caminante 5y ago
    After re-reading, it sounds like there's an additional "are you sure" flag if the file came from outside your organization. My point is that macros are already disabled by default. If you're going to get phished or engineered, then adding more "are you sure" prompts is of questionable value, without trying to sound overly cynical about InfoSec. Bottom line: if the "feature" is not explained in a straight-forward way to a tech-savvy crowd like HN, then I have a lot of questions about its efficacy.
Anon4Now 5y ago
From the article: > Attackers have already had to adapt to tricking users into affirmatively running macros, but the new moratorium means targets would have to carry out a much more involved process to be infected—making it much less likely that attackers will be able to successfully guide them through it. I didn't see a description of the new process, but it sounds like they beefed it up some.
- technion 5y ago
  Right click on the file, click properties, click "unblock". Or use the Powershell command "Unblock-File". Close and reopen. it's not actually a new process, it's just a changed default. Some businesses set that default years ago.
technion 5y ago
For all intents and purposes, macros are enabled by default. Yes, there's a simple "Click to enable" prompt. Everyone looks at it as "the button you need to click to load the document". People do it without even realising because it's so benign looking. Look at the Word document in this campaign, which is just one example of many: https://www.bleepingcomputer.com/news/security/new-trickbot-campaign-spamming-malicious-complaint-doc-attachments/ https://www.bleepingcomputer.com/news/security/new-trickbot-... I can only relate to the experience of sending out phishing tests that rely on users clicking "enable". Either the business has it disabled by a policy, or the success rate will be close to 100%.

pishpash 5y ago

I'm reading it as it being disabled beyond a confirmation modal. You probably have to change some file attribute to re-enable it, perhaps. Edit: Yep, from the linked article inside the article - "Once a user opens an attachment or downloads from the internet an untrusted Office file containing macros, a message bar displays a Security Risk that the file contains Visual Basic for Applications (VBA) macros obtained from the internet with a Learn More button. The Learn More button goes to an article for end users and information workers that contains information about the security risk of bad actors using macros, safe practices to prevent phishing & malware, and instructions on how to enable these macros by saving the file and removing the Mark of the Web (MOTW)."

caminante 5y ago

I'm perplexed too! How does this article reconcile with the existing disabled by default practice? > Security Warning Macros Have Been Disabled [enable content] At best, the headline is still misleading. Macros are already disabled. Clicking more "are you sure?" prompts is different and dubious

gruez 5y ago
>How does this article reconcile with the existing disabled by default practice? AFAIK it's usually combined with some sort of social engineering attack to get the user to bypass the warning. eg. "this document is password protected by Adobe Protect™ to view document, click enable macros".
- caminante 5y ago
  After re-reading, it sounds like there's an additional "are you sure" flag if the file came from outside your organization. My point is that macros are already disabled by default. If you're going to get phished or engineered, then adding more "are you sure" prompts is of questionable value, without trying to sound overly cynical about InfoSec. Bottom line: if the "feature" is not explained in a straight-forward way to a tech-savvy crowd like HN, then I have a lot of questions about its efficacy.

Anon4Now 5y ago

From the article: > Attackers have already had to adapt to tricking users into affirmatively running macros, but the new moratorium means targets would have to carry out a much more involved process to be infected—making it much less likely that attackers will be able to successfully guide them through it. I didn't see a description of the new process, but it sounds like they beefed it up some.

technion 5y ago
Right click on the file, click properties, click "unblock". Or use the Powershell command "Unblock-File". Close and reopen. it's not actually a new process, it's just a changed default. Some businesses set that default years ago.

technion 5y ago

For all intents and purposes, macros are enabled by default. Yes, there's a simple "Click to enable" prompt. Everyone looks at it as "the button you need to click to load the document". People do it without even realising because it's so benign looking. Look at the Word document in this campaign, which is just one example of many: https://www.bleepingcomputer.com/news/security/new-trickbot-campaign-spamming-malicious-complaint-doc-attachments/ https://www.bleepingcomputer.com/news/security/new-trickbot-... I can only relate to the experience of sending out phishing tests that rely on users clicking "enable". Either the business has it disabled by a policy, or the success rate will be close to 100%.