Cisco’s Talos security bods predict new wave of Excel Hell

It took a few years and one temporary halt, but in July Microsoft finally began blocking certain macros by default in Word, Excel, and PowerPoint, cutting off a popular attack vector for those who target users of Microsoft's Windows OS and Office suite. While recent versions of Office block Visual Basic for Applications (VBA) …

[Woodnag]

Workaround

Change the default program for .xll to Notepad or similar. Create or copy a text file to the desktop, then change suffix from .txt to .xll. Right click the file, and change the default program. Job done, snarf down some Fuller's London Pride to (ex)celebrate.

[Anonymous Coward]

Re: Workaround

Avoid Microsoft softrware altogether, and you strip a massive attack footprint from your infrastructure. Cheaper too..

[Christopher Reeve's Horse]

Re: Workaround

Avoid flying altogether, and strip a massive risk of being in an aviation accident from your life. Cheaper too.

I mean yeah, but...

Yes, yes, I know there are many alternatives to a lot of MS products, but they ain't always possible, feasible, practical, etc.

[Anonymous Coward]

Re: Workaround

That's merely stating the very fact that Microsoft would not want anyone to talk about. Annoying, I know :).

[Michael Wojcik]

Re: Workaround

And as long as businesses insist on putting Microsoft Office on every damn end-user machine, we'll need workarounds like changing the handler for .XLL. (I believe such a change could be pushed via Group Policy, though I haven't actually tried it.)

[Frank Bitterlich]

Re: Workaround

... until next week when MS comes up with a new version of Notepad that can actually use XLL files.

It's laughable that in 2022 MS still thinks letting anybody execute arbitrary code packaged in a nice litte file that you can send by email is a good idea.

[Nevermind]

Meanwhile a major UK defence contractor is busy converting all its forms, docs and reports to excel and circulating around its supply chain and partner orgs...wonder what'll happen when an infection occurs?

[Anonymous Coward]

Earth shattering kaboom?

:)

[Anonymous Coward]

"They exist to let third-party apps add extra functionality to the spreadsheet"

There's your problem!

[ThatOne]

Hacking is an extra functionality all right. All is going according to (marketing) plan.

[Michael Wojcik]

"Excel is already a nightmare of ill-conceived misfeatures, but what if we added more misfeatures?"

[ThatOne]

Perfect bait

> "Details of Project Marketing Plan and Facebook Google Ads Results Report."

OMG, marketing will be all over that bait! Career-enhancing informations not meant for you, just a click away, who cares about some stupid techie warnings!

^{Obviously it's a little too juicy to be honest if you bother thinking about it (it only lacks a "only for the marketing director's eyes!" part), but then again marketing has never been too bright and greed can move mountains.}

[Anonymous Coward]

Two words in the same sentence......again!!

Quote: "...cybercriminals from targeting Microsoft..."

...and the words are "cybercriminals".....and you get to guess the other word!!

...clue......it begins with the letter "M".....

...and this has been going on since the Brain virus in 1986.....see link: https://en.wikipedia.org/wiki/Brain_(computer_virus)

Yup........thirty six years......and still counting.......