64
votes
Is it safe to store account credentials in an Excel sheet protected with a password?
No. At best, password-encrypted Excel sheets are only protected at rest, not while opened. At worst, it's not encrypted and/or an adversary can use one of several documented MS office password ...
- 10.8k
37
votes
Accepted
Is it safe to store account credentials in an Excel sheet protected with a password?
In the existing answers, a lot of "Excel is not secure" gets thrown around, so let's look at what this means in detail.
First, we need to establish which Excel feature we are talking about. ...
- 3,006
7
votes
Accepted
Does "=cmd" CSV injection still exist in 2020?
Finally found the reason why the payload were not executing: DDE launch was disabled in Excel options.
If someone has the same issue, this setting can be found in
File → Options → Trust Center → ...
- 281
6
votes
Is it safe to store account credentials in an Excel sheet protected with a password?
Probably not, but it depends on your threat model.
What are you trying to protect AGAINST ?
If your main concern is that you forget passwords and that some low-level attacker might get them, then you ...
- 10.2k
6
votes
Is it safe to store account credentials in an Excel sheet protected with a password?
No, absolutely not safe
Here is the top google result for
how to crack excel password
It literally tells you how to open a password-"protected" excel spreadsheet.
There are dozens more ...
- 1,250
4
votes
Can a text file disguised as .xlsm be malicious?
.xlsm files are equivalent to .xlsx, except that macros are automatically enabled. Macros are very dangerous and equivalent to arbitrary code execution on your computer, and you should never accept ...
- 131
2
votes
Crack windows excel password
office2john is designed for encrypted files, not files that just have an easily-removable snake-oil protection field. Anyway, here's a quick implementation of the algorithm that they use:
#!/usr/bin/...
1
vote
Accepted
How safe is a password protected Excel file?
AES-256 is the gold standard when it comes to symmetric encryption. However, the caveat here is the strength of the key.
If the key used is a 256-bit randomly generated key generated by a CSPRNG, ...
- 22.1k
1
vote
Does malicious MS Office xlsb file with macros posses risk to OpenOffice?
I will post a 2 steps answer here.
will macros targetting MsOffice VBA be executed by OpenOffice?
AFAIK no. Even if OpenOffice macros can use VBA syntax, they cannot use the Microsoft VBA objects to ...
- 26.1k
1
vote
Is it safe to store account credentials in an Excel sheet protected with a password?
This is not safe for the reasons stated in other answers, however a quick alternative for the same stuffy offices environments where Excel is being used is often to pack the spreadsheet into an ...
- 113
1
vote
Accepted
Exfiltrate data by injecting functions in Excel 2007 file rendered with PHP
After a few trials and errors, I have manage to extract data but also I find the following article one of the most comprehensive reaource for data exfiltration using excel formula:
https://www....
- 1,840
1
vote
External command execution in Excel formulas
The functionality to run arbitrary code was an intentional feature that Microsoft added. Back when office was released the whole threat molded was different, we did not share files like we do today. ...
- 1,672
Only top scored, non community-wiki answers of a minimum length are eligible