Is it possible to create a certificate for an Excel workbook which has some VBA macros, and distribute the certificates to a small group of users?
Remou's answer is spot on, but be aware though that, dependent on the user's security settings, self-certified projects might only replace the standard macro security warning with another about self-signed projects - not exactly a win in my book as it can confuse already wary users.
In a small group this may not be an issue, but then neither should asking them to click 'Enable' to the standard dialog...
The only way to completely get round this is to purchase a full-fat signing certificate - $$$
This may be of interest: Self Certify projects
Related
I have an Excel tool (xlsm file) I'm spreading to users, they download the file from our site and after that can use it. In a nutshell:
the tool has its own menu bar and a bunch of macros that e.g. do calculations, pull in data from an API, etc.
I use Unviewable to hide the code from the users
I sign the VBA project with a certificate
Last month, an user reported having issues running the tool and passed it on to his IT department. They came back with several ASR rules they had to switch off to make the tool work (all macros etc). They were reluctant to do so because of "general virus threats". These were the 3 rules they had to switch off:
Attack surface reduction (ASR) rules reference
Block Win32 API calls from Office macro
Block execution of potentially obfuscated scripts (js/vbs/ps)
Block JavaScript or VBScript from launching downloaded executable content
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide
So my question 1 is: I think the obfuscated scripts line has to do with Unviewable, but have no idea what can cause the other 2 items in that list. Does anyone have an idea? Maybe some references in my project?
And the second question: as I signed my tool with a certificate, wouldn't that for that IT department be a fix - just allow macros that are signed (and add my certificate to the trusted publishers in Excel)?
I am trying in our installer to add a macro that is available to every worksheet. What we presently do in our wix installer is (both 32-bit & 64-bit):
msOfficeApp.Workbooks.Add
msOfficeApp.Workbooks.Open (Session.Property("ExcelMacroLoc") & "AutoTagExcelMacro.xla")
msOfficeApp.Workbooks("AutoTagExcelMacro.xla").RunAutoMacros 1
...
<Property Id="ExcelMacroLoc" Value='C:\' />
<CustomAction Id="AssignExcelMacroLoc" Return="check" Execute="firstSequence" Property ='ExcelMacroLoc' Value='[INSTALLDIR]'>
</CustomAction>
This works sometimes, but not always. Oftentimes we get some or all of the below. What is the best way to tell Excel where this VBA script is and that it's ok to use in any worksheet?
I think the issues/questions are:
Is there anything in this macro (AutoTagExcelMacro.xla) that needs to change (written in 2000)?
Should the file's extension be changed to .xlam? And does that require any other changes?
How do I digitally sign the xla file?
How do I figure out where Excel is installed (to know where to install the macro)?
How do I determine the bitness of Excel (GetBinaryType does not work).
Is there anything else I need to do besides copy the xla file to the appropriate folder?
Also asked on MSDN (I'll post any answer from there here).
" #ProfoundlyOblivious Could you please post an answer telling us how to do each part best - digitally signing, trusted location, etc. and what/where we should tell people to look for macros being disabled? – David Thielen "
Disclosure: I am not an expert in software deployment, my knowledge is limited to the obstacles I encountered sharing my VBA solutions among peers on IT managed networks.
Note: The dialog boxes in your post do not all originate from the same cause. The first relates to security and the others to file availability.
Security
Macros have been, and still are, used in the development and circulating of malicious software. As a result macros are disabled by default and require user interaction to run.
Macro Security Settings
Macros are enabled through the Trust Center, which is accessed through the file menu. These settings are independent for each Office application and some applications may have additional options involving the suppression of a dialog box. Such as Excel where all macros may be disaabled without notification or all macros may be disaabled with notification. There are three basic settings for all Office applications summarized as:
Disable all macros
Disable all unsigned macros
Enable all macros (Not Recommended)
I strongly recommend that one does not enable all macros. It may achieve a desired result but I believe the risk is far too great to warrant the consideration.
Digitally Signed Macros
A digitally signed macro in and of itself simply means the underlying code has not been changed by anyone since last saved by the signer. If the signer's certificate is installed on a computer as a trusted publisher then macros signed with that certificate can run without notification under the requisite macro security setting.
In corporate environments, IT may retain a library of certificates and there may be an established procedure for an internal developer to submit a project for wider circulation, whereafter IT signs the project so it can be run with minimal intervention.
In my experience however, I have found many companies do not have an SOP for this process or that the process is prohibitively onerous. At such times, I turn to self-signed certificates. A self-signed certificate if miraculous for personal development because it provides ample flexibility without incurring the risk if allowing unsigned code to run. The problem, of course, then comes with sharing your code because the recipient will not have your certificate installed. They could install my certificate but my personal preference is that I send an unsigned project and they create a certificate and sign the project themselves. This is an easy step-by-step process that requires no skill beyond the ability to follow instructions.
Trusted Location
A document saved in a trusted location can run macros without notifications. Trusted locations are added in the Trust Center.
By default, XLStart is a trusted location
File Availability
When Excel is opened, it will try to refresh links to other data sources and add-ins. Those files must be open for a successful refresh and a dialog box will appear if the refresh fails.
Based on little more than experience and deduction, I believe this message is often semi-erroneous and driven by either the lack of a time out timer or too short of one. I have tested this with a simple worksheet and a simple add-in. The message pops saying the link could not be updated but it was open and updated by the time I manually check the status of the connection.
In other words, the dialog box was an iritation that served no value.
There is an option that suposedly offers some control over the "Links Could Not Be Updated" window with options along the lines of:
Update links and notify
Update links and do not notify
I have found these settings unreliable and prone to resets from crashes and updates.
To the best of my knowledge, the most assured way if avoiding this type of warning is to install the add-in after Excel is stable and uninstall the add-in before Excel closes. Of course this comes with it's on set of problems including a user perceivable slower loading time.
I would like to know how I can achieve the following:
Have Excel open without the request to "Enable Macros" for an Excel sheet that is distributed as a template and filled in by many, to then come back to a script of mine that wants to read the contents of the Excel sheet (Macros are only there for the users).
Any actions that require me to perform a change to my own installation of Excel (such as adding the file to the trusted docs), won't work, since the computer that runs the script, can be any of a 1000 computers that contains the automated script.
Signing the Excel sheet (something I read here, could solve the issue), is fine, but I would like to know how to go about his, when operating from within an enterprise, governed with a lot of security regulations.
I don't have access to alter the trust center settings, nor can I click the "enable macro's" button every time...
All help is welcome.
The simplest solution is to store the template in a "Trusted Location" - that is a folder on your network where macros are allowed. You can either set the template's current location as trusted, or move the template into an existing trusted location. Your IT dept should be able to set up such a location if they don't already have one enabled in people's profiles. You'll have to talk to your IT dept because it's unlikely your users can alter this setting themselves.
Fortunately noone can do this. If it was allowed to automatically prevent the "Enable Macros" security warning pop-up, this would have been a huge security issue:
However, you may contact the people using the template and ask them to enable all macros from the Trust Centre:
This is how to navigate to the Trust Centre in Excel:
Microsoft Office Button
Excel Options
Trust Center
Trust Center Settings
Macro Settings
Enable or disable macros in Office files
Vityata's solution only works if your enterprise security policy allows trusting network drives. It doesn't work in our environment as our security policy disables trusting network drives.
I handled the issue on a much smaller scale by self-signing the macros and installing my cert on the client's computers. I only have a few clients that use the scripts I write so it's not a big deal for me.
However, to do this at scale would require your IT dept to distribute your cert via their Windows update mechanism. You have to have admin access to your machine and a second as a test platform for this to work.
The steps you would take would be:
Create your self-signed cert.
Sign the macro.
Test it works on another machine by installing your cert on the other machine and running the macro.
Send the cert to your IT dept for them to distribute.
Send the spreadsheet to your clients.
I'm working on an alternative approach of setting our department up as a certificate authority and issuing properly signed certs internally for our own use. We have a plethora of devices that don't have fully qualified domain names assigned to them because the network group doesn't want to deal with the overhead of maintaining thousands of certs. As you might imagine, it's a project to get all the pieces in play so that one person can handle it.
Looking for solution to be able to allow our CRM users to sign online documents on our site , is there opensource solution for this ?
basically we will be signing the documents on behalf of the customer for the supplier but of course customer himself will be signing online, so here we will use one certificate to sign for different customers... timestamp and other features required to be the legal,
and if there is open source solution or one of small cost product would cover Annex1 and Annex2 all the required points
http://www.berr.gov.uk/files/file49952.pdf
we found this but would this work on Linux servers http://www.signfiles.com/digital-certificates/ and ItextPDF but would any of this be ok for legal side of things ?
Thnx
You might want to check out a service like DocuSign which already has integrations with major CRMs. Your main issue here is proving that it actually happened and that it's legally binding. The best way to do this is not to have an open source solution that you control, but to rely on a trusted 3rd party.
Full disclosure: I work for DocuSign.
Is there any way to programmatically remove the digital signature from the VBA macros of an Excel sheet?
i.e. code that is equivalent to entering the VBA editor, going to Tools menu -> Digital Signature and clicking Remove.
Interesting question.
It's deliberately not part of the Excel object model for security reasons.
It is possible to remove the certificate from the certificate store. This requires Win32 api calls (which can be made from VB6 or VBA but I'm not sure of the exact effect on your project once you do this...
It will definately invalidate the certificate, but I don't know if it will remove it.
Also you may not wish to remove the certificate from the store (since you could be using it for something else).
To view the certificate store, type, certmgr.msc at the Run prompt.
anyway a link on how to remove a certificate programmatically.
KB article showing how to remove a trusted root certificate from the store.
Requirements:
1. You'll need to download the Windows SDK for the appropriate platform to get the capicom dll's, + regsvr32 them
2. You'll need to extract the public key from the certifcate you want to remove.
3. Test with a uninmportant workbook first, I have no idea whether this method will (apart from invalidating the certificate) also cause corruption in the workbook. Hopefully someone has a better suggestion than this.