6 ms·

Social engineering will be always effective, but that's not the point. This /is/ a problem with VBA - as a person viewing a document, it doesn't seem like you'r

Social engineering will be always effective, but that's not the point. This /is/ a problem with VBA - as a person viewing a document, it doesn't seem like you're running anything, but really you're running arbitrary unsigned code that has full r/w access to everything on your system. To make it worse, this has been a major attack vector for over a decade yet it's still completely unsandboxed.

gnaritas 11y ago
That's not really true, it doesn't run by default, the user is prompted and warned about possible malicious scripts AND they run them anyway. All you have to do is put instructions/picture in the doc telling the user to click that button to see the content, and they usually will. Users are simply ignorant of the dangers, that's the problem and it's always been the problem and that's unlikely to change.
- makmanalp 11y ago
  I know it doesn't run by default - a warning about malicious scripts is a cop out and everyone knows it. Yes, if we trained everyone to be programmers, then maybe no one would click it. However, the point is, how do I know what will happen when I click this button? Will it run a helpful macro to format my data or will it delete all my files? Why is a macro language allowed to do that? Why do those two things have the same security level assigned to them? You should run executables only from trusted sources - that's what we're told, right? Now - do you trust an email appearing to genuinely be from a very prestigious honor society from the world's largest CS authority? Why not? Why was the person not able to cryptographically verify that, yes, that is indeed where this file came from? What is that - you say that since they didn't know the sender personally, they shouldn't have trusted the file anyway? A different example: What if, say, someone used windowsupdate or apt-get as an attack vector? I bet you're trusting those strangers already, as we speak, and you have pretty much no say in the matter. "Oh, we'll put in a warning dialog" is the most crappy duct-tape there-I-fixed-it style solution to this extremely nuanced problem, and blaming the user does nothing to secure real world systems.
  - gnaritas 11y ago
    > You should run executables only from trusted sources - that's what we're told, right? No, that's what computer savvy people know, normal users don't think twice about running an executable from any source, that's the whole point. Nothing you suggested will stop what people simply do continually, open anything from anyone without caring who the sender is. Sandboxes don't just protect things, they forbid necessary and useful things so you can't simply sandbox everything because users will simply refuse to use your crippled software and opt for the less secure but more functional version. Users don't care about security, that's the problem; it's a social problem, not a technical one.
- xorcist 11y ago
  There has historically been countless of ways to circumvent that prompt, even after they put it in there. If you opened a txt file in your editor, which then installed spyware on your computer, wouldn't you put the blame squarely on your editor?
  - gnaritas 11y ago
    Yes, but docs are text files, they're binary.

gnaritas 11y ago

That's not really true, it doesn't run by default, the user is prompted and warned about possible malicious scripts AND they run them anyway. All you have to do is put instructions/picture in the doc telling the user to click that button to see the content, and they usually will. Users are simply ignorant of the dangers, that's the problem and it's always been the problem and that's unlikely to change.

makmanalp 11y ago
I know it doesn't run by default - a warning about malicious scripts is a cop out and everyone knows it. Yes, if we trained everyone to be programmers, then maybe no one would click it. However, the point is, how do I know what will happen when I click this button? Will it run a helpful macro to format my data or will it delete all my files? Why is a macro language allowed to do that? Why do those two things have the same security level assigned to them? You should run executables only from trusted sources - that's what we're told, right? Now - do you trust an email appearing to genuinely be from a very prestigious honor society from the world's largest CS authority? Why not? Why was the person not able to cryptographically verify that, yes, that is indeed where this file came from? What is that - you say that since they didn't know the sender personally, they shouldn't have trusted the file anyway? A different example: What if, say, someone used windowsupdate or apt-get as an attack vector? I bet you're trusting those strangers already, as we speak, and you have pretty much no say in the matter. "Oh, we'll put in a warning dialog" is the most crappy duct-tape there-I-fixed-it style solution to this extremely nuanced problem, and blaming the user does nothing to secure real world systems.
- gnaritas 11y ago
  > You should run executables only from trusted sources - that's what we're told, right? No, that's what computer savvy people know, normal users don't think twice about running an executable from any source, that's the whole point. Nothing you suggested will stop what people simply do continually, open anything from anyone without caring who the sender is. Sandboxes don't just protect things, they forbid necessary and useful things so you can't simply sandbox everything because users will simply refuse to use your crippled software and opt for the less secure but more functional version. Users don't care about security, that's the problem; it's a social problem, not a technical one.
xorcist 11y ago
There has historically been countless of ways to circumvent that prompt, even after they put it in there. If you opened a txt file in your editor, which then installed spyware on your computer, wouldn't you put the blame squarely on your editor?
- gnaritas 11y ago
  Yes, but docs are text files, they're binary.