Macro SecurityEstimated reading time: 8 minutes
Macro security involves mitigating the opening and uploading of Excel files that contain macros to ensure no malicious code affects any system. These macro files have the file extension of .xlsm, as opposed to a macro free file extension of .xlsx. These macro files can potentially contain malicious code that when opened via the Report Library, can execute harmful actions. New versions of the Interject Add-In (versions 2.4.x and above) will contain configurations that will mitigate this risk.
The overall goal of macro security is to ensure a macro file is not opened in the Interject Report Library without it matching the exact file that was uploaded. There are security attack vectors where a previously downloaded file can be replaced or if a file is a direct file path, the file could be later replaced. If the Interject platform database becomes compromised there are additional attack vectors to be considered.
Since the Report Library trusts all macro files inherently and sidesteps macro warnings, we must be sure the file is valid before opening to ensure Interject protects the user. With this functionality, Interject can also be a better security vehicle to allow macro files while disabling them in the network.
Uploading A Macro File
Interject macro security involves enabling/disabling macro file transactions to/from the Report Library. If enabled, when the file is uploaded, a checksum is created on the file. Next, the client’s signing key from the Interject Cloud Platform is used on the checksum to create a signed hash. This hash is a unique identifier that is stored in the Interject Cloud Platform for the uploaded file.
Opening A Macro File
When a user attempts to open a file from the Report Library, the file is downloaded to the cache so a signed hash can be created. The two signed hashes are then compared. If they do not match, the file is deleted and the file open is denied. If they do match, the file is opened. This feature prevents unauthorized altercation of uploaded files from being opened. If the hashes do not match then an admin user can download the file for inspection. The file then can be reviewed and re-uploaded to create a new signed hash.
There are key settings that can be used to configure macro security. They can only be set up in the Interject Platform API which are cached locally in an encrypted file. Local settings in the IDSSettings.xml or App.config file are not used since they are not encrypted and could be used to override macro security settings by bad actors. Currently, only Interject can setup and change these settings.
The macro security related settings are:
|ExcelMacrosEnabled||Enables upload/open of macro files. If this setting is missing AND the MacroFileSigningKey or FileSigningAPI settings have been set, then those can be used to enable a valid upload/open uploading of macro files.||True/False|
|AllowMacroFilesFromDate||Allows users to open files that have been uploaded before this date. This setting makes it possible for users to be able to continue to utilize their existing reports after macro security has been introduced. Typically this setting date is set to the date when macro security is to be implemented.||Date|
|MacroFileSigningKey||A key that is used to digital sign the macro files.||Long string of characters|
|FileSigningAPI||A link to an API that will digital sign the macro files.||URL Link|
|FileSigningAPI_V2||Currently not used.||URL Link|
|AdditionalFileExtensionsAllowed||Allows a company to upload/open unauthorized file types||List of File Extensions (e.g.”.ppt, .pptx”)|
|FileExtensionsNotAllowed||Prohibits a company to upload/open authorized file types||List of File Extensions (e.g. “.doc, .docx”)|
The security settings can be set up for each client/company. To confirm the settings, navigate to Interject Diagnostics > Public > Apply Special Features:
The following displays which file types are allowed to upload/open from the Report Library (if the company has rights):
|Excel||xls||Excel file (97-2003)|
|Excel||xlsm||Excel file (macro enabled)|
|Excel||xlt||Excel template file (97-2003)|
|Excel||xltx||Excel template file|
|Excel||xltm||Excel template file (macro enabled)|
|Excel||xlsb||Excel binary file|
|Word||doc||Word document (97-2003)|
|Adobe||Portable Document Format file|
|Image||png||Portable Network Graphic file|
|Image||jpg||Joint Photographic Experts Group file|