Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) document? Note that I am not asking for ways in which to crack or brute-force the password. I know that Excel 2003 uses RC4 for the encryption scheme. However, it does not store files in the same zip like structure that 2007 and 2010 does.

Additional Updates: This is for a forgotten "File Open" and not VBA password. I would be happy to hex edit the file too if I could find the specifications for where the password was stored. An example used for VBA file removal is listed here, http://gbanik.blogspot.co.uk/2010/08/understanding-excel-file-internals.html, and this is something sort of like what I am looking for except for the "File Open" password.

share|improve this question
    
I assume that you do not know the password? –  schroeder Aug 30 '12 at 20:11
    
There is a file open password that has been forgotten. Cannot read the spreadsheet until it is removed. I am also not sure what you mean by stored in the heads. –  John Aug 30 '12 at 20:16
    
Maybe you want just to save it without password, or just null it, right? –  Andrew Smith Aug 30 '12 at 22:18
    
@AndrewSmith, that is correct, just null the password would be good. –  John Aug 30 '12 at 22:20

2 Answers 2

up vote 7 down vote accepted

See this blog post which links to the official documentation. As the blog post explains, it seems that the encryption uses RC4 with a 128-bit key which is derived form the password; BUT (and that's the important point) the derivation truncates the unknown values at some point, down to 40 bits (see section 2.3.6.2). So, for a given document (using the salts and other values which are in the document header), there are only 240 possible RC4 keys, and that's workable with a PC in a fortnight (the blog post states that it could be lowered to "a few minutes" with GPUs, which is a bit exaggerated and unsubstantiated, especially since RC4 does not map well on GPU).

The challenge is finding software which does the exploration, from sources which are sufficiently respectable-looking that you would not fear running it on your PC. The other solution is programming it yourself.

(I had begun something like that at some point, but the file owner suddenly remembered the password and my effort stopped. So I quite believe that it is doable, and not very hard, but I have no code to show.)

share|improve this answer
    
+1 on this. I discovered how terrible their XLS encryption is on older documents when I was looking into OpenXML. Thankfully the new documents (.xlsx) have a much stronger design. –  Polynomial Aug 31 '12 at 6:12
    
crackxls2003 (which I wrote) is a program to do this. –  Gavin Smith Mar 31 at 4:26

Probably if a similar feature exists in 2003. Note that this is only bypasses workbook "protection" where you have viewing access to parts of a spreadsheet but from within excel you have no obvious permission to edit.

Microsoft is aware this doesn't provide security; its meants as a convenience against accidental editing:

http://office.microsoft.com/en-us/excel-help/overview-of-security-and-protection-in-excel-HP005238854.aspx

Yes, a bad name/design (something like this should never have a password protection) as I'm sure idiots out there will think its stronger than its not easily bypassable. However, you can additionally password protect the entire file by encrypting it with a password (but then unprivileged users would not be able to view the data).

share|improve this answer
    
I think he's stuck with the other password issue: can't open the file to view it. –  Jeff Ferland Aug 30 '12 at 21:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.