6 ms·

That's not the right move. The right move would be a sandbox around every word/excel file being viewed/opened. Ideally, backed by a kernel mechanics such as Cre

That's not the right move. The right move would be a sandbox around every word/excel file being viewed/opened. Ideally, backed by a kernel mechanics such as CreateRestrictedToken WinAPI. What they are doing instead, shifting responsibility to end users. Specifically, they're simply training users to click on "I agree" buttons.

jimbob45 5y ago
I think you’re right. Fifteen years ago would have been the right time to disable macros by default. Now, we have the technology to sandbox everything to largely mitigate security concerns. However, sandboxing is a much higher investment from MS’ POV. This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today.
- jodrellblank 5y ago
  > "This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today." cough https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://docs.microsoft.com/en-us/windows/security/threat-pro... That's been built into Windows 10 Pro since Dec 2018.
- iancarroll 5y ago
  I don’t think any platform, either Linux or Windows, has successfully implemented secure sandboxing aside from true virtualization, if that. The isolation provided by kernel-level sandboxing like cgroups has proven to be a thin layer of protection in practice; it will just shift the problem to fixing sandboxing issues.
  - kritr 5y ago
    I think https://gvisor.dev/ https://gvisor.dev/ might be the closest thing I can think of to container level sandboxing that tries to add meaningful security guarantees.
- kritr 5y ago
  https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview https://docs.microsoft.com/en-us/windows/security/threat-pro... Office “Sandboxing” is a thing today.
upofadown 5y ago
If you sandboxed enough to prevent bad things, you would break the functionality of good things. If people were not using these features then they would not exist.
kevingadd 5y ago
People will just break out of the sandbox because macros are often used to do things that can't be sandboxed.
varenc 5y ago
> they're simply training users to click on "I agree" buttons Are macros at all common? My perception is they're very very rarely used, especially in file downloaded from the internet. In that context, a file asking for permission to run macros would seem pretty strange to the user and that they might actual reconsider things before clicking I agree.
- technion 5y ago
  The prompt to enable macros is near identical to the "protected mode" prompt, that users must click in order to do things like "print" and "copy to clipboard". No user ever questions it. To answer your question though, pretty much every place I've worked with had people writing VBA macros.
- scandox 5y ago
  Wrong. They are the number one security problem for email in traditional business, state and semi-state sectors. Certainly in my corner of Europe. I always ask orgs to consider a blanket ban on them but almost none can go that far. They are extremely widely used and shared among healthcare, pharmaceutical, government councils and many other types of organisations.
- delusional 5y ago
  They're pretty rare in files from the internet, but normal people don't really regard "files from the internet" and "this attachment of an email" as separate concepts. In traditional business (like banking, where I have my experience) macros are EXTREMELY common. Both in local files, and in what normal users would consider remote files (from intranet sites and email).
usrbinbash 5y ago
"The right move" would be for them to do away with programmable documents altogether, and replace them with a simple scripting language that reads and generates documents, similar to how static HTML is generated by template languages. That way, it would be clear for users that they are not "opening a document" but "execute a program". There simply is no need to conflate documents and programs.
- technion 5y ago
  They actually did a long time ago. A word .docx can't execute code. If it has a macro, it's a .docm, which is usually blocked on mail systems. The problem of course is the legacy of .doc, which is both of those in one filename.
magicalhippo 5y ago
> Specifically, they're simply training users to click on "I agree" buttons. It's even worse IMO. Want to copy the value Excel is displaying in a cell to the clipboard? Gotta click agree to enable macros! WTF?!

jimbob45 5y ago

I think you’re right. Fifteen years ago would have been the right time to disable macros by default. Now, we have the technology to sandbox everything to largely mitigate security concerns. However, sandboxing is a much higher investment from MS’ POV. This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today.

jodrellblank 5y ago
> "This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today." cough https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://docs.microsoft.com/en-us/windows/security/threat-pro... That's been built into Windows 10 Pro since Dec 2018.
iancarroll 5y ago
I don’t think any platform, either Linux or Windows, has successfully implemented secure sandboxing aside from true virtualization, if that. The isolation provided by kernel-level sandboxing like cgroups has proven to be a thin layer of protection in practice; it will just shift the problem to fixing sandboxing issues.
- kritr 5y ago
  I think https://gvisor.dev/ https://gvisor.dev/ might be the closest thing I can think of to container level sandboxing that tries to add meaningful security guarantees.
kritr 5y ago
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview https://docs.microsoft.com/en-us/windows/security/threat-pro... Office “Sandboxing” is a thing today.

upofadown 5y ago

If you sandboxed enough to prevent bad things, you would break the functionality of good things. If people were not using these features then they would not exist.

kevingadd 5y ago

People will just break out of the sandbox because macros are often used to do things that can't be sandboxed.

varenc 5y ago

> they're simply training users to click on "I agree" buttons Are macros at all common? My perception is they're very very rarely used, especially in file downloaded from the internet. In that context, a file asking for permission to run macros would seem pretty strange to the user and that they might actual reconsider things before clicking I agree.

technion 5y ago
The prompt to enable macros is near identical to the "protected mode" prompt, that users must click in order to do things like "print" and "copy to clipboard". No user ever questions it. To answer your question though, pretty much every place I've worked with had people writing VBA macros.
scandox 5y ago
Wrong. They are the number one security problem for email in traditional business, state and semi-state sectors. Certainly in my corner of Europe. I always ask orgs to consider a blanket ban on them but almost none can go that far. They are extremely widely used and shared among healthcare, pharmaceutical, government councils and many other types of organisations.
delusional 5y ago
They're pretty rare in files from the internet, but normal people don't really regard "files from the internet" and "this attachment of an email" as separate concepts. In traditional business (like banking, where I have my experience) macros are EXTREMELY common. Both in local files, and in what normal users would consider remote files (from intranet sites and email).

usrbinbash 5y ago

"The right move" would be for them to do away with programmable documents altogether, and replace them with a simple scripting language that reads and generates documents, similar to how static HTML is generated by template languages. That way, it would be clear for users that they are not "opening a document" but "execute a program". There simply is no need to conflate documents and programs.

technion 5y ago
They actually did a long time ago. A word .docx can't execute code. If it has a macro, it's a .docm, which is usually blocked on mail systems. The problem of course is the legacy of .doc, which is both of those in one filename.

magicalhippo 5y ago

> Specifically, they're simply training users to click on "I agree" buttons. It's even worse IMO. Want to copy the value Excel is displaying in a cell to the clipboard? Gotta click agree to enable macros! WTF?!