Visio Guy

Visio Discussions => Programming & Code => Topic started by: Visisthebest on March 20, 2021, 03:14:10 PM

Title: Office VBA digital signature serious security issue!
Post by: Visisthebest on March 20, 2021, 03:14:10 PM
Microsoft identified a security issue with signed VBA code, more info here:
https://developer.microsoft.com/en-us/sharepoint/blogs/upgrade-signed-office-vba-macro-projects-to-v3-signature/

"This vulnerability might enable a malicious user to tamper with a signed VBA project without invalidating its digital signature."

That is very serious, code with malware/ransomware could be released by a bad actor under someone else's digital signature, making it look like they (for instance a reputable company) released this malicious piece of software.
Title: Re: Office VBA digital signature serious security issue!
Post by: Surrogate on March 20, 2021, 05:57:43 PM
VBA macro with digital signature?  :o
I never meet it  ;)
Title: Re: Office VBA digital signature serious security issue!
Post by: Visisthebest on March 20, 2021, 07:04:23 PM
It is useful for macros used by companies with IT security policies.
Title: Re: Office VBA digital signature serious security issue!
Post by: Surrogate on March 20, 2021, 07:51:38 PM
About 2 years ago i read discussion "VBA death come soon"!
Supportes of conspiracy theory have called the first sign of the beginning of this: VBA will declare potentially dangerous. After that, large companies (IT security policies) will begin to refuse it, and so on...
Title: Re: Office VBA digital signature serious security issue!
Post by: Thomas Winkel on March 20, 2021, 09:29:23 PM
Like 70% of the world economy depends directly on VBA. ;D
VBA will never die :P
Title: Re: Office VBA digital signature serious security issue!
Post by: Visisthebest on March 21, 2021, 10:08:02 AM
OfficeScripts for Excel, "the successor of VBA", is still far removed from VBA's capabilities. For Visio there is no OfficeScripts...

Meanwhile Visual Basic is getting a huge new Visual Studio Code-based solution with which you can develop VB and VB.NET applications, when they add VBA to this solution it will be huge. See https://www.twinbasic.com/

This guy has also developed vbWatchDog, by far the best error handler for VBA I could find. Saves tons of development time because error handling in VBA is terrible and this error handler does it for you. See https://www.everythingaccess.com/vbwatchdog.asp

vbWatchDog isn't cheap though, $295 with one year support, but if you hate writing error handling code in VBA it is worth it.