Macro Security

Overview

Macro security involves mitigating the opening and uploading of Excel files that contain macros to ensure no malicious code affects any system. These macro files have the file extension of .xlsm, as opposed to a macro free file extension of .xlsx. These macro files can potentially contain malicious code that when opened via the Report Library, can execute harmful actions. New versions of the Interject Add-In (versions 2.4.x and above) will contain configurations that will mitigate this risk.

The overall goal of macro security is to ensure a macro file is not opened in the Interject Report Library without it matching the exact file that was uploaded. There are security attack vectors where a previously downloaded file can be replaced or if a file is a direct file path, the file could be later replaced. If the Interject platform database becomes compromised there are additional attack vectors to be considered.

Since the Report Library trusts all macro files inherently and sidesteps macro warnings, we must be sure the file is valid before opening to ensure Interject protects the user. With this functionality, Interject can also be a better security vehicle to allow macro files while disabling them in the network.

Uploading A Macro File

Interject macro security involves enabling/disabling macro file transactions to/from the Report Library. If enabled, when the file is uploaded, a checksum is created on the file. Next, the client's signing key from the Interject Cloud Platform is used on the checksum to create a signed hash. This hash is a unique identifier that is stored in the Interject Cloud Platform for the uploaded file.

Opening A Macro File

When a user attempts to open a file from the Report Library, the file is downloaded to the cache so a signed hash can be created. The two signed hashes are then compared. If they do not match, the file is deleted and the file open is denied. If they do match, the file is opened. This feature prevents unauthorized altercation of uploaded files from being opened. If the hashes do not match then an admin user can download the file for inspection. The file then can be reviewed and re-uploaded to create a new signed hash.

Security Settings

There are key settings that can be used to configure macro security. They can only be set up in the Interject Platform API which are cached locally in an encrypted file. Local settings in the IDSSettings.xml or App.config file are not used since they are not encrypted and could be used to override macro security settings by bad actors. Currently, only Interject can setup and change these settings.

The macro security related settings are:

Checking Settings

The security settings can be set up for each client/company. To confirm the settings, navigate to Interject Diagnostics > Public > Apply Special Features:

File Extensions

The following displays which file types are allowed to upload/open from the Report Library (if the company has rights):