Malicious Mobile Code

Office 2000 Security

Office 2000 introduced a new security feature, built around digital signatures, to diminish the threat of macro viruses. Office 2000 automatically trusts macros (written in VBA6) that were digitally signed from authors who have been previously designated as trusted . Not all Office 2000 applications have the new feature, but Word, Excel, Outlook, and PowerPoint, do. Access, FrontPage, Publisher, and PhotoDraw, do not (although Access does have its own security mechanisms). Users must have Internet Explorer 4.0 or higher for the security to work. When opening a document containing macros, depending on security settings, Office may notify you, as shown in Figure 5-7, that untrusted macros are present.

Figure 5-7. Office 2000 macro warning dialog box

Office cannot ascertain whether the macro is dangerous or not, only that document contains macro code. You can choose to disable (the default option) the macros while opening the document, or enable them. Interestingly, the document path and name Office displays in the warning dialog box is not always the current location of the item. Don’t let the bug confuse you.

Security Levels

In Office 2000, you can set macro security as High, Medium, or Low, within each supported application. Figure 5-8 shows the different options. High, the default, will disable all unsigned or untrusted macros, and accept all signed trusted macros. ...