A VBA project can be protected with a read-password: a password you need to enter in order to be able to view and edit the VBA project in the VBA IDE.

I've never gave much attention to documents with password protected VBA code, because it's just that: a protection, enforced by the IDE. The VBA code itself is not encoded or encrypted, you can view it with my tool oledump.py or Philippe's tool olevba.py without any problem. In fact, you won't even notice that it is password protected if you use our tools.

To see with my tool if a VBA project is password protected, you take a look at the PROJECT stream. This stream is pure text, structured like an INI file. You will find an ID entry, usually the first line, with a GUID as value. This GUID is unique per VBA project, unless the VBA project is password protected. A password protected VBA project has a "NULL" GUID: ID="{00000000-0000-0000-0000-000000000000}"

Here is an example of the PROJECT stream of a VBA project without password:

And here is an example of the PROJECT stream of a VBA project with password:

Notice that entry DPB (ProjectPassword) is longer: that's because this ID contains the hash of the password. All this is explained in MS-OVBA 2.3.1.16.

I've never tried to crack password hashes like these, because the VBA code is not encoded/encrypted when a password is set. And if you want to remove the password, you can take the ID, DPB, CMG and GC entries of a VBA project without password, and use them as replacement values in the password protected VBA project.

But if you would happen to know of a free open-source tool to crack VBA project passwords (i.e recover the password, not remove it), please post a comment.   

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Posted by InfoSec News on Jul 13

https://www.defenseone.com/technology/2020/07/defense-bill-could-rewrite-how-us-does-cyber-defense/166806/

By Patrick Tucker
Technology Editor
Government Executive
July 10, 2020

A new Office of Joint Cyber Planning proposed in an amendment to the 2021
defense policy bill aims to help government and private actors respond more
quickly to cyber attacks mounted from Russia, China, and elsewhere.

“The Office shall lead Government-wide and...
 

Posted by InfoSec News on Jul 13

https://www.cyberscoop.com/secret-service-reorganization-task-force-cybercrime-financial-crime/

By Shannon Vavra
CYBERSCOOP
July 9, 2020

The Secret Service is combining its Electronic Crimes Task Forces (ECTFs) and
Financial Crimes Task Forces (FCTFs) into one unified network, the agency
announced Thursday.

The new merged network of task forces, to be known as Cyber Fraud Task Forces
(CFTFs), will detect, prevent and root out cyber-enabled...
 

Posted by InfoSec News on Jul 13

https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/

By Matthew Green
July 10, 2020

Over the past several months, Signal has been rolling out a raft of new
features to make its app more usable. One of those features has recently been
raising a bit of controversy with users. This is a contact list backup feature
based on a new system called Secure Value Recovery, or SVR. The SVR feature...
 

Posted by InfoSec News on Jul 13

https://www.bloomberg.com/news/articles/2020-07-10/hacked-elections-can-harm-sovereign-credit-ratings-moody-s-says

By Eric Lam
Bloomberg.com
July 10, 2020

The threat of cyber attackers subverting elections around the world puts not
just democratic institutions at risk but also a country’s creditworthiness,
according to Moody’s Investors Service.

Among countries with popular national elections, Moody’s sovereign-credit
ratings and...
 

Posted by InfoSec News on Jul 13

https://www.vice.com/en_us/article/wxqz54/secret-service-network-investigative-technique-ransomware

By Joseph Cox
Vice.com
July 10, 2020

A Seattle Police Department officer tried to unmask a ransomware attacker by
deploying his own hack, according to newly unsealed court records.

Although in this case the officer's attempt didn't work, the news shows that
the use of so-called network investigative techniques (NITs)—the U.S....
 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

An anonymous reader asked if the malicious document Brad discussed in his latest diary entry, was "purged". VBA purging means that the compiled VBA code (PerformanceCache) is missing.

And indeed, if you use my tool oledump.py with option -i, you get more information and you can see that the PerformanceCache data is not present:

0+2359 means that the size of the PerformanceCache data is 0, and that the size of the CompileSourceCode data is 2359 bytes: this VBA code is indeed purged.

I took a look at the metadata to get an indiction if the document was created with Office and then VBA purged, or if a custom tool was used that does not generate PerformanceCache data. Since it is an OOXML file, I looked for the properties XML files (docProps):

And as you can see, the metadata is missing too.

It's not that the docProps files have been deleted, they are also not referenced in the Content_Types file:

I need to take a better look to have more confidence, but now I would be inclined to think that this document was created with a custom tool.

Update: I just noticed that the VBA code is also password protected.

Update 2: I have even more confidence, now I'm thinking this document was created with C# library EPPlus.

 

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Internet Storm Center Infocon Status