Re: how to tell if anything evil lurking in an .xls file?
You could save it in the native format of Gnumeric or OpenOffice.org Calc,
then convert it back to xls.
That will likely strip out any nastiness hiding in the original xls file.
You know you can set Security Level = {Medium,High} in Office right?
All along there is no tool to view all of what's inside an .xls file
in cleartext or whatever. All I can use is less(1). All I can do is
trust that other programs are doing the right thing inside their black
boxes. There is no total dumper that shows what is going on in every
part of the .xls file.
I mean here I am distributing
http://jidanni.org/geo/taipower/programs/contrib/alho.zip
with no idea if it is all clean or not... and also wondering if such
tiny .xls programs can use less than the 14KB, or is that the smallest
.xls file possible?
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Thu, Feb 12, 2004 at 02:52:53AM +0800, Dan Jacobson wrote: All along there is no tool to view all of what's inside an .xls file in cleartext or whatever. All I can use is less(1). Maybe the output of 'strings' would be useful too? I've not worked with xls files before but it may help if 'less' is helping. signature.asc Description: Digital signature
Re: how to tell if anything evil lurking in an .xls file?
On Thu, Feb 12, 2004 at 02:52:53AM +0800, Dan Jacobson wrote: All along there is no tool to view all of what's inside an .xls file in cleartext or whatever. All I can use is less(1). All I can do is trust that other programs are doing the right thing inside their black boxes. There is no total dumper that shows what is going on in every part of the .xls file. Both .doc and .xls files are OLE Structure Storage documents, which are minature file systems: they contain any number of streams stored in a hierarchical fashion. Each stream has a name, a type (I think it's numeric or can be a string?), and a sequence of bytes. All files will contain a version info stream for which there is a pubic spec. There are also several streams of various types, the main document stream, various revision streams, some bookkeeping streams, and the VBA code (the nastiness) in a stream. The hard part about importing those docs is interpreting the document streams, as that spec isn't public. But it should be easy to enumerate the streams and tell if any are the VBA type. I am making unsubstantiated assertions here but I believe data and code streams are separate, and VBA streams can be readily identified by name or type. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
But if I convert it to .cvs format, all the =... formulas of the spreadsheet are lost. All I am left with is just a snapshot of what it looked like on the face of it. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Tuesday 10 February 2004 05:02 pm, Dan Jacobson wrote: But if I convert it to .cvs format, all the =... formulas of the spreadsheet are lost. All I am left with is just a snapshot of what it looked like on the face of it. Ok. I have another idea, then. You could save it in the native format of Gnumeric or OpenOffice.org Calc, then convert it back to xls. That will likely strip out any nastiness hiding in the original xls file. Adam -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Tue, Feb 10, 2004 at 06:57:54PM -0500, Adam Aube wrote:
On Tuesday 10 February 2004 05:02 pm, Dan Jacobson wrote:
But if I convert it to .cvs format, all the =... formulas of the
spreadsheet are lost. All I am left with is just a snapshot of what
it looked like on the face of it.
Ok. I have another idea, then.
You could save it in the native format of Gnumeric or OpenOffice.org Calc,
then convert it back to xls.
That will likely strip out any nastiness hiding in the original xls file.
You know you can set Security Level = {Medium,High} in Office right?
High = don't run nastiness
Medium = prompt about potential nastiness
I think it would be safer to save the files as the ancient Lotus 1-2-3
format.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Tuesday 10 February 2004 07:11 pm, Nano Nano wrote:
You know you can set Security Level = {Medium,High} in Office right?
Yes, but I was trying to give the OP a solution he could implement on his
end. He probably can't control the macro settings the recipients of the
file have.
I think it would be safer to save the files as the ancient Lotus 1-2-3
format.
Perhaps, though the OP may have the same problem as with CSV - loss of
essential content.
Adam
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Tue, Feb 10, 2004 at 07:22:18PM -0500, Adam Aube wrote:
On Tuesday 10 February 2004 07:11 pm, Nano Nano wrote:
You know you can set Security Level = {Medium,High} in Office right?
Yes, but I was trying to give the OP a solution he could implement on his
end. He probably can't control the macro settings the recipients of the
file have.
I think it would be safer to save the files as the ancient Lotus 1-2-3
format.
Perhaps, though the OP may have the same problem as with CSV - loss of
essential content.
When I worked at Microsoft I read some Office internal planning
documents that said that 90% of spreadsheet users overwhelmingly use
them for entering a paged-sized grid of numbers and making a bar chart.
That said, the MS-internal accounting mananagment type folks would
present some a-f*cking-mazing spreadsheets, all linked to ERP data and
with the most amazing formatting you've ever seen. !!!
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
how to tell if anything evil lurking in an .xls file?
How can one tell if anything evil is lurking in an .xls file? Gnumeric, openoffice, etc. have selections to show properties, but that doesn't give me confidence about all the mess that less(1) shows exists. I wouldn't want to pass an evil .xls along to my MS buddies. Also how can one reduce the bloat that must be surely in there, just as one wishes to strip FONT etc. from a FrontPage document. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: how to tell if anything evil lurking in an .xls file?
On Sunday 08 February 2004 04:13 pm, Dan Jacobson wrote: How can one tell if anything evil is lurking in an .xls file? Safest way: Convert it to CSV before sending it along. However, if the XLS file has no macros, then it is probably safe. Adam -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
