1

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read this was extremely unsafe. This project is for work and to be distributed to possibly many terminals, but before I ask them to check this setting I wanted to know if this is something that is considered safe.

1

If you look at the docs at https://support.office.com/en-us/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 macros are disabled by default and there are multiple options to enable them.

Users should be encouraged to use the ”principle of least privilege” which in this case means to only enable macros in documents where they trust the author, and were expecting the document, and for the most limited amount of time. So the option on that page ”Enable macros for one time when the Security Warning appears” is best.

Why? You don't want your users to open spam emails that looked important to trick victim into opening the document to have a macro script steal data or install back doors.

From the user perspective is it unsafe to ever enable macros? If write my own macro and run it on a clean laptop then obviously not. If my mom opens a document that runs a macro that was emailed to her by “amazing@online-deals.us” then obviously yes.

It is implicit in the fact it asks you to confirm whether you want to enable scripting that the system requires the user to confirm that they know it is safe to trust the origin and author of the VBA script.

One might be able to argue that the VBA engine makes it too easy to attack people in this way. Historically people have argued that Microsoft products are fundamentally unsafe simply because there were so many exploits and victims. Yet clearly they have invested a lot of effort into trying to make it safer for unknowledgable users by blocking scripting by default. Some users might simply always run all scripts without considering the consequences or checking the origin of the documents they are opening. Yet at least they were given a choice and the defaults were secure.

So why might Microsoft let you enable scripting across the board which is less safe than letting users have to confirm for each document? Why let someone disable security features? Probably for backwards compatibility when the security feature was first introduced. They used to not block macros, blocking them might have caused issues for some customers who know they are always secure (eg no external emails allowed to certain users), so there is a opt-out to disable that security feature, which makes sense for a very small number of customers. You should not encourage users to disable any security features.

  • I added an update to the question, basically, sounds like you are saying it's not secure in my use case since it's being distributed to many users and I can't guarantee their level of knowledge to avoid being a victim. I don't think I'll ever use this unless it's a personal project, but even then I assume there is a better way. (I ended up distributing this as an Excel AddIn) – FreeSoftwareServers Mar 22 at 5:10
  • If your writing the code it’s only unsafe if you are the attacker. – simbo1905 Mar 22 at 6:05
  • unless this forces them to enable scripting for all documents not just yours? in which case then yes, you are removing a defence that makes it more likely that they can be tricked. Ideally, they should only have to enable scripting on a per document basis. Then they can be trained to enable it for your documents as they can trust you but not documents sent by untrustworthy people. Of course of an attacker knows that they open and trust your documents they can spoof your email address to sent a targeted attack document. – simbo1905 Mar 22 at 6:10
  • That was the problem, it required them to globally enable trusting the VBA project. Asking them to do that each time would be ridiculous, but I suppose that could be a measure and this is I security website... But that's really impractical. – FreeSoftwareServers Mar 22 at 6:11
  • support.office.com/en-us/article/… says that they can trust the current document your don't have to have them trust all documents. you should document that they only run macros for content the they trust when they open the document (the first approach on that page). I will update my answer. – simbo1905 Mar 22 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.