Hacker News Reader

Comment by hans1729 | Hacker News Reader

It’s a thing in big orgs, where macros are enabled in excel and employees can be tricked into opening mail attachments. Windows defender should suffice, but like you said, from a compliance/insurance perspective it may me valuable to say “look, we scanned for signatures according to the latest knowledge of [insert vendor]”.

Personally I think that it’s ridiculous that these huge orgs fail to address the actual underlying issue, excel macros. But hey, it’s easier to fight the Symptome than to deal with the root cause, especially if the latter would impact established work flows god knows how far down the line.

View on HN

I think if Excel macros were banned in finance, trading volume would drop by several hundred billion dollars per day.

Are you giving the pros or the cons?

Seriously though... Maybe this is something that should be done.

I seem to recall an article about a big org, probably in Finance, which took a serious look at the Excel Macro thing. Only a puny fraction of their employees, pretty much all in a couple specialized departments, actually used those. SO - outside of those few and their dept's, all macros were disabled/banned by fiat. Which allowed the relevant malicious-macro-prevention resources & training to be focused on those few.

I would really hope my organization doesn't start blanket banning excel macros for "security". It'll be a huge blow to productivity for several.

Draconian bans probably aren't the best way to achieve it, but if it's productivity your org wants they should concentrate on migrating those workflows out of Excel ASAP.

So which accountant is going to be programming your node.js files?

There's a reason companies use excel.

They'd just learn Python. They'd be fine.

I won't, even when I do know how to script in Python. We don't really like having our workflows disrupted for silly reasons

You can't just "#learntocode" Excel macros away from industry.

The problem with macros is that people are running arbitrary code that's emailed to them. I don't see how Python solves that at all. If someone isn't checking the macros in the sheet they received before running it, they're also not going to check the code in the Python script.

I have personally watched Windows Defender fail to notice a real virus infection from a USB flash drive. The USB flash drive was plugged in and instantly Windows was infected - Windows Defender did nothing. You could then manually run a Windows Defender scan and it would find the infection but it would not prevent the infection.

I think one's need for a security product should match one's exposure to issues - it depends on your org. For a very long time I was not a fan of anti-virus, in 2022 I'm back to liking anti-virus (more like EDR these days).

Would one of the commercial antivirus products have caught it, though? Did you check?

Yes. It was not a current virus, came from an old UEB flash drive that had been lying around for years. GravityZone noticed it and prevented it, which is why I knew to go look at the Win10 box the flash drive was last plugged into. Windows Defender's silence would have left us with the virus installed because it was not periodically scanning on its own.

MS Defender used to automatically scan USB devices when plugged in but that's not the default anymore (and AFAIK hasn't been for a few years since one of the major updates); you now have to enable it somewhere non-intuitive (like the Policy Editor?).

That's a really bizarre choice of default setting.

Not really, when you consider that there are tens of thousands of USB devices that work with Windows, many of which can operate like a flash drive even though they aren't (like cameras). I can imagine MS disabling this feature by default due to the headaches involved.

Notably, autolaunching USB drives is also no longer the default option for USB devices. The user has to specifically choose what action happens when the device is first plugged in (and by default, that choice only applies to the current instance; the user must manually choose to have the choice apply the next time the device is plugged in).

My point is that people thinking that Windows 10 comes with Windows Defender, and that Windows Defender will protect them by default, are in for a surprise. Defender probably is not doing anything you might think it should, by default.

dont confuse BitDefender with Windows Defender, not the same thing

I did not confuse them. Yes, I mentioned GravityZone in a follow - which is a BitDefender product, and is the product that found the issue when Windows Defender did not.

What mechanism would a flash drive use to infect a modern version of Windows by only being plugged in?

The class of risky employees should perhaps be limited to Chromebooks only.

Unfortunately I don’t think belittling these employees helps much here, especially considering how good a dedicated phisher can become at their craft.

CEOs?

This may work some of the time, but expect "I need $windows_program" to foul your chances of this. It may not always be legitimate, but telling heavy-duty transport mechanics they can't have Cummins or Bendix software (for engines and brakes) to help them diagnose, when that's the only output for troubleshooting supported by the OEM, will not end well.

This makes me thing: When we are going to see those Windows software directly on the web?

For me makes a lot of sense being able to sell a software subscription instead of a one time product sell, and for the other hand making available to use in any device in the world with internet connection.

This also can be done like Chrome apps (like Docs) or some Electron apps (like Spotify), where you can use content without Internet for some time without any problem.

For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.

> For a mechanic who is looking for the amount of torque needed on a bolt this could be perfectly viable, for example.

We're going to start talking past each other pretty quickly if you think this is worthy of a (software) service subscription. Torque specs belong in a manual (ideally on corporate intra-net or paper); I'm talking about when the engine is deeply unhappy, and you need more to go on than a driver reporting a yellow check light.

In the case of the latter, I'd say it absolutely deserves to be a 20 year old program (which tend to be lighter) that runs entirely offline. The last thing any garage wants to do is chase hardware requirements or search for a wifi signal either out in the yard, or in between hoists, lifts, and miscelleaneous heavy equipment / tooling - all of which tend to trash a wifi signal.

This is already a thing. Plenty of companies use managed virtual desktops via the web for this purpose.

AWS even offers "Workspaces" as service for this.

Though it doesn't solve the "without the internet" problem.

This is why people don't like IT staff a lot of time. They think their needs of making their own jobs easier outweigh those of the organization and getting stuff done.

The bigger problem is that the IT staff is often so ludicrously underfunded, that they ARE a bottleneck. There probably are ways to manage team/personal productivity with organization needs, but without time to dedicate to analysis, you get blanket solutions. Which is another reason why self-provisioned SaaS rather than IT managed systems are big.

The software we develop should have better interfaces too. A security expert should also review stuff created by UX.

Back when “I love you” virus started, we had pointed out something simple as “open for read” vs “open as in run/execute” should not have had the same interface.

All the new security enhancements we have today - don’t run as admin, alerts to request privileged access, sandboxing - all of them existed for a decade, but the software vendors never had the guts to weigh security higher than UX

Microsoft has done more damage than anybody by hiding known extensions by default.

Even the script kiddies fall into that trap, my old school got infected by a .pdf.js.js ...

Reply on news.ycombinator.com