signature to be recognized as good Macro (and not removed)

[Tequilaman]

I use Visual Basic regulary for many things, mainly connected to Excel, sometimes to Word and very few times to Powerpoint.

Now sometimes these must be used in different countries and sometimes changes take days, because somebody is afraid to bypass our remover.

Did anybody try to build in kind of a signature to clearly show a 'good' one (=created by me) and differentiate it from an 'unknown' one that will be removed. - There is great fear of Trojans right now (again).

Ideas? - I think about it for days and in fact the only idea I had would be kind of a Trojan itself to bypass the remover on condition that the Macro has a certain key as a comment in a certain line.

[BlackMustard]

I use Visual Basic regulary for many things, mainly connected to Excel, sometimes to Word and very few times to Powerpoint.

Now sometimes these must be used in different countries and sometimes changes take days, because somebody is afraid to bypass our remover.

Did anybody try to build in kind of a signature to clearly show a 'good' one (=created by me) and differentiate it from an 'unknown' one that will be removed. - There is great fear of Trojans right now (again).

Ideas? - I think about it for days and in fact the only idea I had would be kind of a Trojan itself to bypass the remover on condition that the Macro has a certain key as a comment in a certain line.

There is an official way to "digitally sign" macros. I can't remember exactly how to do it, but I bet you can find the procedure on microsoft.com or by googling.

-bm

[Tequilaman]

Do you mean the ancient Microsoft Secure Signature, 'secure' was the joke about it...

The problem with this ancient procedure from 2001 or 2002 is, that our IT security doesn't accept it since there have been one or two Trojans that slipped through these check years ago in some companies somebody of them has been before.

I really try to develop something where I can use my security code that uses symbols from different languages in a combination that is very unique and too crazy that anybody would try it... The encoding key is there, I just need a way to check it.

[BlackMustard]

Do you mean the ancient Microsoft Secure Signature, 'secure' was the joke about it...

The problem with this ancient procedure from 2001 or 2002 is, that our IT security doesn't accept it since there have been one or two Trojans that slipped through these check years ago in some companies somebody of them has been before.

I really try to develop something where I can use my security code that uses symbols from different languages in a combination that is very unique and too crazy that anybody would try it... The encoding key is there, I just need a way to check it.

well, since it's possible to open .bas files (code modules) as text files, the idea to have a comment on a certain line and check for that line to contain the right value isn't that bad. but keep in mind that whichever way you do it, if you write a program that will bypass an automated remover, that program will in itself be a security risk, since hackers could use it. and if you write a program that is so secure that these IT security people will accept it, it'll be enough work for you to consider other solutions...

there might be other companies than microsoft that issue digital signatures - and there might be newer versions than the ancient 2001/2002 ones - so it could be worth the effort looking into a bit deeper...

[Tequilaman]

Well, I only want to bypass the remover on check of this key signature that I developed years ago. The key is great, I mean really great, since I 'place the mouse on top of the alligator's mouth' again, I guess to use this backdoor to the system won't happen. - Too much effort needed for much too little possible gain.

Hacking into a 128 symbol key mainly consisting of symbols/letters not existing in most languages is really hard work nobody will do for seeing some planning numbers that are probably outdated for a day as soon as you succeed.

What am really looking for is an idea to really write my own bypass that I can really narrow down to such a key, so there is not "I want to phone home"-routine from the creator; I know those signature have wanted weaknesses for user locking themselves out of their system/docs. I want a "right key or destruct", since I can just resend the tool is destructed.

[BlackMustard]

Well, I only want to bypass the remover on check of this key signature that I developed years ago. The key is great, I mean really great, since I 'place the mouse on top of the alligator's mouth' again, I guess to use this backdoor to the system won't happen. - Too much effort needed for much too little possible gain.

Hacking into a 128 symbol key mainly consisting of symbols/letters not existing in most languages is really hard work nobody will do for seeing some planning numbers that are probably outdated for a day as soon as you succeed.

What am really looking for is an idea to really write my own bypass that I can really narrow down to such a key, so there is not "I want to phone home"-routine from the creator; I know those signature have wanted weaknesses for user locking themselves out of their system/docs. I want a "right key or destruct", since I can just resend the tool is destructed.

as far as i understand the removal tool for suspicious software works automatically, so the optimal way would be to actually build your keycheck into the security software. and if that's not possible, i think your trojan version probably is the easiest way.

my concern is not that your trojan won't be a "safe one", but rather that if you can find a glitch in the security system where you could slip macros in if you think they qualify (that is, have the key), someone else could probably build another trojan that does other things or lets other software in without looking for the security key. and that won't be very popular with the security guys...

[Tequilaman]

Well, for that securing of the Trojan bypass I trust my key. I guess knowing how complicated this key is, I can do so.

The security watch dogs wouldn't even understand that key, it was born out of much creativity and some Absinthé ;-)

My only problem is, I don't really find a start programming the first lines of that bypass. For days I keep working on the concept from time to time; basicly between calculators and scenario tools that I usually create.

As soon as I have the first lines it will develop further, but what I usually do in Visual Basic is so different from that. I can use any hint...

[BlackMustard]

Well, for that securing of the Trojan bypass I trust my key. I guess knowing how complicated this key is, I can do so.

The security watch dogs wouldn't even understand that key, it was born out of much creativity and some Absinthé ;-)

My only problem is, I don't really find a start programming the first lines of that bypass. For days I keep working on the concept from time to time; basicly between calculators and scenario tools that I usually create.

As soon as I have the first lines it will develop further, but what I usually do in Visual Basic is so different from that. I can use any hint...

i really must admit that i don't have any idea how it would work either... but i might be able to help brainstorming anyway =) how does the removal tool work that you're trying to bypass?

[Tequilaman]

Well, until now it opens the Excel in kind of a isolated zone, checks for macros and removes any macro there.

The exact routine to do this are not even known by our high-level security guys, it was developed by some eastern European (probably Romanian) IT company. In Western Europe it is hardly used, except us and some Austrian companies.

The only bypass I think is to let the system think that this is not a macro.In fact I do not know how it works with zips, but there the whole File doesn't arrive.

By now, I send the files as 8 letter wit no ".xxx" renamed in a zip, but still this causes so much misunderstanding...

[BlackMustard]

Well, until now it opens the Excel in kind of a isolated zone, checks for macros and removes any macro there.

The exact routine to do this are not even known by our high-level security guys, it was developed by some eastern European (probably Romanian) IT company. In Western Europe it is hardly used, except us and some Austrian companies.

The only bypass I think is to let the system think that this is not a macro.In fact I do not know how it works with zips, but there the whole File doesn't arrive.

By now, I send the files as 8 letter wit no ".xxx" renamed in a zip, but still this causes so much misunderstanding...

well, the most efficient equivalent to a digital certificate would be to get your security people to insert a check routine into the routine that deletes macros. to make this possible without making your secret code available, maybe you could compile a dll with the check routine in it (for example, a function that checks for your special line in a file, with the file as input and true/false as output), and then they could just call the function with some equivalent to "if checkok = true then exit sub" and that way avoid deleting safe files.

again, i think this is something you have to discuss with the security people directly - any attempt to bypass them without their knowledge will be looked upon with suspicion, so if you're frank with them you'll probably get a lot further...

[Tequilaman]

Well, by now I gave up the "good semi Trojan" idea.

There was a more simply way, I have a first Macro distributed by SD cards. This Macro will check files with a certain extension that seems useless (assume .123) for the security code and rename them to xls.

Complicated, but it should work for some time...