5 ms·

It’s a thing in big orgs, where macros are enabled in excel and employees can be tricked into opening mail attachments. Windows defender should suffice, but lik

It’s a thing in big orgs, where macros are enabled in excel and employees can be tricked into opening mail attachments. Windows defender should suffice, but like you said, from a compliance/insurance perspective it may me valuable to say “look, we scanned for signatures according to the latest knowledge of [insert vendor]”. Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.

beamatronic 5y ago
The class of risky employees should perhaps be limited to Chromebooks only.
- hans1729 5y ago
  Unfortunately I don’t think belittling these employees helps much here, especially considering how good a dedicated phisher can become at their craft.
- d3ad1ysp0rk 5y ago
  CEOs?
- 29083011397778 5y ago
  This may work some of the time, but expect "I need $windows_program" to foul your chances of this. It may not always be legitimate, but telling heavy-duty transport mechanics they can't have Cummins or Bendix software (for engines and brakes) to help them diagnose, when that's the only output for troubleshooting supported by the OEM, will not end well.
  - jmrm 5y ago
    This makes me thing: When we are going to see those Windows software directly on the web? For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection. This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem. For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.
    - 29083011397778 5y ago
      > For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example. We're going to start talking past each other pretty quickly if you think this is worthy of a (software) service subscription. Torque specs belong in a manual (ideally on corporate intra-net or paper); I'm talking about when the engine is deeply unhappy, and you need more to go on than a driver reporting a yellow check light. In the case of the latter, I'd say it absolutely deserves to be a 20 year old program (which tend to be lighter) that runs entirely offline. The last thing any garage wants to do is chase hardware requirements or search for a wifi signal either out in the yard, or in between hoists, lifts, and miscelleaneous heavy equipment / tooling - all of which tend to trash a wifi signal.
    - jacobr1 5y ago
      This is already a thing. Plenty of companies use managed virtual desktops via the web for this purpose. AWS even offers "Workspaces" as service for this. Though it doesn't solve the "without the internet" problem.
- stjohnswarts 5y ago
  This is why people don't like IT staff a lot of time. They think their needs of making their own jobs easier outweigh those of the organization and getting stuff done.
  - jacobr1 5y ago
    The bigger problem is that the IT staff is often so ludicrously underfunded, that they ARE a bottleneck. There probably are ways to manage team/personal productivity with organization needs, but without time to dedicate to analysis, you get blanket solutions. Which is another reason why self-provisioned SaaS rather than IT managed systems are big.
- harikb 5y ago
  The software we develop should have better interfaces too. A security expert should also review stuff created by UX. Back when “I love you” virus started, we had pointed out something simple as “open for read” vs “open as in run/execute” should not have had the same interface. All the new security enhancements we have today - don’t run as admin, alerts to request privileged access, sandboxing - all of them existed for a decade, but the software vendors never had the guts to weigh security higher than UX
  - alternatetwo 5y ago
    Microsoft has done more damage than anybody by hiding known extensions by default. Even the script kiddies fall into that trap, my old school got infected by a .pdf.js.js ...
dartharva 5y ago
I would really hope my organization doesn't start blanket banning excel macros for "security". It'll be a huge blow to productivity for several.
- excalibur 5y ago
  Draconian bans probably aren't the best way to achieve it, but if it's productivity your org wants they should concentrate on migrating those workflows out of Excel ASAP.
  - behringer 5y ago
    So which accountant is going to be programming your node.js files? There's a reason companies use excel.
- slowmovintarget 5y ago
  They'd just learn Python. They'd be fine.
  - dartharva 5y ago
    I won't, even when I do know how to script in Python. We don't really like having our workflows disrupted for silly reasons
  - jmt_ 5y ago
    You can't just "#learntocode" Excel macros away from industry.
  - ziml77 5y ago
    The problem with macros is that people are running arbitrary code that's emailed to them. I don't see how Python solves that at all. If someone isn't checking the macros in the sheet they received before running it, they're also not going to check the code in the Python script.
carnitine 5y ago
I think if Excel macros were banned in finance, trading volume would drop by several hundred billion dollars per day.
- saalweachter 5y ago
  Are you giving the pros or the cons?
  - sjmm1989 5y ago
    Seriously though... Maybe this is something that should be done.
annoyingnoob 5y ago
I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Windows was infected - Windows Defender did nothing. You could then manually run a Windows Defender scan and it would find the infection but it would not prevent the infection. I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).
- 3np 5y ago
  Would one of the commercial antivirus products have caught it, though? Did you check?
  - annoyingnoob 5y ago
    Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.
- gamblor956 5y ago
  MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).
  - ridgered4 5y ago
    That's a really bizarre choice of default setting.
    - gamblor956 5y ago
      Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved. Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).
bell-cot 5y ago
I seem to recall an article about a big org, probably in Finance, which took a serious look at the Excel Macro thing. Only a puny fraction of their employees, pretty much all in a couple specialized departments, actually used those. SO - outside of those few and their dept's, all macros were disabled/banned by fiat. Which allowed the relevant malicious-macro-prevention resources & training to be focused on those few.

beamatronic 5y ago

The class of risky employees should perhaps be limited to Chromebooks only.

hans1729 5y ago
Unfortunately I don’t think belittling these employees helps much here, especially considering how good a dedicated phisher can become at their craft.
d3ad1ysp0rk 5y ago
CEOs?
29083011397778 5y ago
This may work some of the time, but expect "I need $windows_program" to foul your chances of this. It may not always be legitimate, but telling heavy-duty transport mechanics they can't have Cummins or Bendix software (for engines and brakes) to help them diagnose, when that's the only output for troubleshooting supported by the OEM, will not end well.
- jmrm 5y ago
  This makes me thing: When we are going to see those Windows software directly on the web? For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection. This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem. For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.
  - 29083011397778 5y ago
    > For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example. We're going to start talking past each other pretty quickly if you think this is worthy of a (software) service subscription. Torque specs belong in a manual (ideally on corporate intra-net or paper); I'm talking about when the engine is deeply unhappy, and you need more to go on than a driver reporting a yellow check light. In the case of the latter, I'd say it absolutely deserves to be a 20 year old program (which tend to be lighter) that runs entirely offline. The last thing any garage wants to do is chase hardware requirements or search for a wifi signal either out in the yard, or in between hoists, lifts, and miscelleaneous heavy equipment / tooling - all of which tend to trash a wifi signal.
  - jacobr1 5y ago
    This is already a thing. Plenty of companies use managed virtual desktops via the web for this purpose. AWS even offers "Workspaces" as service for this. Though it doesn't solve the "without the internet" problem.
stjohnswarts 5y ago
This is why people don't like IT staff a lot of time. They think their needs of making their own jobs easier outweigh those of the organization and getting stuff done.
- jacobr1 5y ago
  The bigger problem is that the IT staff is often so ludicrously underfunded, that they ARE a bottleneck. There probably are ways to manage team/personal productivity with organization needs, but without time to dedicate to analysis, you get blanket solutions. Which is another reason why self-provisioned SaaS rather than IT managed systems are big.
harikb 5y ago
The software we develop should have better interfaces too. A security expert should also review stuff created by UX. Back when “I love you” virus started, we had pointed out something simple as “open for read” vs “open as in run/execute” should not have had the same interface. All the new security enhancements we have today - don’t run as admin, alerts to request privileged access, sandboxing - all of them existed for a decade, but the software vendors never had the guts to weigh security higher than UX
- alternatetwo 5y ago
  Microsoft has done more damage than anybody by hiding known extensions by default. Even the script kiddies fall into that trap, my old school got infected by a .pdf.js.js ...

dartharva 5y ago

I would really hope my organization doesn't start blanket banning excel macros for "security". It'll be a huge blow to productivity for several.

excalibur 5y ago
Draconian bans probably aren't the best way to achieve it, but if it's productivity your org wants they should concentrate on migrating those workflows out of Excel ASAP.
- behringer 5y ago
  So which accountant is going to be programming your node.js files? There's a reason companies use excel.
slowmovintarget 5y ago
They'd just learn Python. They'd be fine.
- dartharva 5y ago
  I won't, even when I do know how to script in Python. We don't really like having our workflows disrupted for silly reasons
- jmt_ 5y ago
  You can't just "#learntocode" Excel macros away from industry.
- ziml77 5y ago
  The problem with macros is that people are running arbitrary code that's emailed to them. I don't see how Python solves that at all. If someone isn't checking the macros in the sheet they received before running it, they're also not going to check the code in the Python script.

carnitine 5y ago

I think if Excel macros were banned in finance, trading volume would drop by several hundred billion dollars per day.

saalweachter 5y ago
Are you giving the pros or the cons?
- sjmm1989 5y ago
  Seriously though... Maybe this is something that should be done.

annoyingnoob 5y ago

I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Windows was infected - Windows Defender did nothing. You could then manually run a Windows Defender scan and it would find the infection but it would not prevent the infection. I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).

3np 5y ago
Would one of the commercial antivirus products have caught it, though? Did you check?
- annoyingnoob 5y ago
  Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.
gamblor956 5y ago
MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).
- ridgered4 5y ago
  That's a really bizarre choice of default setting.
  - gamblor956 5y ago
    Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved. Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).

bell-cot 5y ago

I seem to recall an article about a big org, probably in Finance, which took a serious look at the Excel Macro thing. Only a puny fraction of their employees, pretty much all in a couple specialized departments, actually used those. SO - outside of those few and their dept's, all macros were disabled/banned by fiat. Which allowed the relevant malicious-macro-prevention resources & training to be focused on those few.