Questions tagged [office]

Microsoft Office is an office software suite that includes Word, Excel, Power Point, Access and Outlook.

Filter by
Sorted by
Tagged with
0
votes
0answers
65 views

How secure is Microsoft's Office and LibreOffice's password protection?

AFAIK both Microsoft Office and LibreOffice have features to add passwords to protect the content. In general, there are two ways: protect from editing/changing (without a revision at least) protect ...
1
vote
1answer
218 views

Is it safe to enable - Trust Access to the VBA object model - Microsoft Office

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read ...
2
votes
2answers
89 views

What are the pitfalls of bypassing a proxy to access cloud services such as G Suite or Office 365?

According to a TechNet article published by Microsoft, one of its recommendations is to bypass proxies to access Office 365.The basic premise is focused on performance as opposed to security. ...
1
vote
1answer
71 views

Does the file encryption of Microsoft Office guarantee integrity?

I stumbled upon Microsoft Office's feature of file encryption. For storing sensitive data in the cloud, e.g. DropBox, this sounds like a nice feature. Reading that the encryption is AES-128 in CBC ...
1
vote
2answers
114 views

How can I securely edit an Office file that I downloaded from the Internet?

When I open an Office file such as a Word file that was downloaded from the internet, it warns me that it might not be safe to edit unless I trust the file source, but what if I actually need the file ...
1
vote
0answers
89 views

Can Gmail read password protected .docx files?

Can Gmail read MS-Word .docx 2011 (OS X) files that require a password to open? As I understand it, Gmail servers read emails and attachments in their efforts to characterize users for advertising ...
1
vote
1answer
95 views

Social Engineering Attack awareness using .doc and spoofed email

Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and ...
4
votes
1answer
332 views

Exfiltrate data by injecting functions in Excel 2007 file rendered with PHP

I need to extract data from inside an Excel fille using Excel 2007 functions. The concept is somewhat related to stored XSS type of data exfiltration only that I need to use Excel 2007 functions (...
4
votes
1answer
184 views

How should I approach my security team regarding aggressive group policies (VBA / macro blocking)?

My security organization has responded to the threat of macro-based viruses by changing all copies of Excel to no longer run macros/VBA scripts. Through some quick research, it looks like there are ...
-2
votes
1answer
1k views

Can an XXE attack be carried out from within an docx file? [closed]

Is XXE possible in a file upload with .docx files?
6
votes
1answer
594 views

External command execution in Excel formulas

It's known that MS Excel functionality of external references will allow executing arbitrary commands from its formulas with appropriate security warnings and confirmation required from the user. E.g....
1
vote
1answer
69 views

Remote Worker Sharepoint Access Permissions

Here is the problem encountered at my company: We have set of very disorganized files on a Microsoft Sharepoint server I have one person going through and reorganizing everything. In terms of ...
1
vote
2answers
101 views

How to deal with Office documents in file upload?

When creating or testing a file upload functionality how do you deal with Office documents assuming that the client wants to be able to upload .doc/.docx/.xls/.xlsx? I have found quite some reading ...
1
vote
2answers
193 views

How can I hide a DAO or ADODB connection string in a Word document or template?

MS Word documents have a Visual Basic component that allows processes to be executed when specified events occur. One of these events is Document_New(), that can be used like this to pop up a "...
0
votes
1answer
422 views

Check if a password for encrypted ms office document is correct

I am writing a Python program to decrypt a MS Office encrypted document. Referencing This GitHub Repo for reference. Now what I want to do is try bunch of commonly used passwords against the document....
0
votes
1answer
267 views

(Why) does an encrypted MS Office 2010 Spreadsheet (need to) have the password hash “written down”?

To my naive mind, it seems like the encryption of a document with AES should go like this: HumanPassword ---|hash|--> key ---|AES|--> Ciphertext plaintext|--^ And the ...
0
votes
1answer
243 views

Blocking Email Attachment download from outside company in Office 365

In Office 365, Emails can accessed from anywhere (within or outside of the company). Want to block Email attachment download from outside of the company. Emails should be accessible from outside of ...
0
votes
1answer
78 views

Actions to take after suspect PDF was opened

A colleague of mine opened a seemingly genuine PDF attached to an email. We run Office365 and normally malicious attachments are filtered out but this one slipped through. The PDF was opened on an ...
5
votes
4answers
6k views

How can I decrypt a Word document that I know the password to without opening it in a word processor?

I got a question that I thought would be simple but it is proving to be more difficult that I thought it would be. I got a malicious password protected Word document that I want to analyze for IoCs. ...
2
votes
1answer
332 views

Macro injection in different Excel versions

I have found a nice macro injection vulnerability in an Excel export functionality. I can inject =1+1 (or worse) into the exported Excel file. But when opening the file in Excel the formula isn't ...
0
votes
0answers
17 views

Site has broken HTTPS, how can I safely visualize hosted office documents? [duplicate]

A website that contains sources I need for my work has broken HTTPS (certificate signed for a different domain). This makes me think that a MITM attack could be feasible. As the sources are office ...
0
votes
1answer
261 views

Do VB Macro viruses (ie macros in Microsoft office documents) affect modern Linux systems?

In the area I live and work, viruses in outdated and pirated windows systems are absolutely rampant. (Moreso even than in the "normal" world). It's utter madness to plug in a USB drive anywhere. ...
1
vote
2answers
658 views

Checklist for returning a work laptop

Submitting on mobile can update later with more details. You've had a laptop provided to you by your workplace, you may have also used it for some personal web traffic. You've been asked to return it ...
1
vote
1answer
118 views

Is it safe to open word document sent in email in LibreOffice

It's not safe to open doc emails attachements in Microsoft Office, because of evil macros. Is it safe to open same file in Libre office or does it also execute macros?
6
votes
2answers
686 views

Can Google Docs be used to “sanitize” a Word or Excel document?

Sometimes I have to download some Word or Excel documents from uncredible sites. I need not only to read but also to edit them. I heard that the Microsoft Office suite is a very popular attack vector. ...
0
votes
0answers
69 views

What Is The Authorities' Stance On The Use of Microsoft Office For Sensitive Information?

I want to know what the U.S. (or E.U. countries) policy is towards the use of Microsoft Office (particularly local versions) and potentially sensitive information requiring clearance. In particular, ...
1
vote
0answers
322 views

Is is possible to modify the Alternate Data Stream (ADS) in MS Word with Protected View?

Is it possible to modify the Alternate Data Stream (ADS) to prevent .docx to be opened in Protected View for files downloaded from Internet. When is Protected View used? Since Protected View ...
1
vote
1answer
61 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
4
votes
2answers
149 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
4
votes
1answer
9k views

Identify if a certain domain is using Office 365 or Google Mail

I have a list of e-mail domains that i wanted to confirm if they're using Office 365 or Google Mail for mail. Checking MX using Nslookup can do the job but I noted that a few companies will use an ...
8
votes
2answers
3k views

How can I safely view the code of a VBA macro?

I have received a phishing email with the usual bogus bill in the form of a Word document. I am curious about what the probable virus wants to do so I would like to inspect the code. At the moment ...
3
votes
3answers
4k views

Is sending email between different Office 365 domains (and organisations) secure?

Is sending emails between different Office 365 account owned by entirely separate entities secure? I.e. The email never leaves the Microsoft network? If the two are in the same data centre (E.g. ...
2
votes
1answer
613 views

Detecting Malcode in Excel and Word Documents

There are a bunch of tricks to circumvent potentially malicious macros in office documents you receive. My question is how do I [forensically] detect if there are malicious macros in the documents? ...
1
vote
1answer
5k views

Sent images on company WiFi network by accident [duplicate]

I know this was stupid, so I don't need to be told that...here goes: I was at work and thought I was on 4G network on my Android phone but after sending a number of nude pics via a social media app ...
1
vote
1answer
570 views

What security problems are exposed by running untrusted macros in excel?

Here's a 2015 article arguing that Macro-based malware is making a comeback. Obviously running untrusted macros is bad news, but what are the specific problems? As far as I understand, VBA can do ...
0
votes
1answer
396 views

Office password protection crack

would just like to have a check on the password protection/encryption of MS office 2007 and above. It is said that its not that easy to crack the password protection except by brute force, since 2007 ...
3
votes
5answers
6k views

Password protect an excel file for a period of time?

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...
2
votes
1answer
889 views

What are the risks when processing a document with Apache POI?

Apache POI is a Java library for processing office documents. What are the risks associated with processing untrusted documents? For example, a web site that allows users to upload documents that are ...
1
vote
1answer
502 views

What is the most secure way to create a REST consumer in a MS word/excel (2013) document

I am looking at a choice for consuming a rest service from a word document. As far as I can tell there are 2 choices. Using a .net apps as listed here: http://msdn.microsoft.com/en-us/library/...
5
votes
5answers
644 views

Is there a simple and highly secure office suite?

I am designing a highly restricted workstation build for a secure environment. At the minute this is planned to use Windows 7, but I am considering Linux. The users will on occasion open documents ...
4
votes
2answers
8k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
1
vote
1answer
894 views

What are the security issues relating to macro enabled MS office documents?

Are there any security issues relating to macro enabled MS office documents?
6
votes
2answers
16k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What ...