Cracking password protection

Your post does not comply with Rule 11 of our Forum RULES.

Don't post questions regarding breaking or bypassing any security measure. Such posts will be deleted, and repeat offenders will be banned. This includes posting of links to sites that offer software, code or services to do this or posting of code to remove passwords

Thread Closed

Hi,

Zbor and I have had discussions and I think we have a way forward. We both realise that you're not asking HOW to crack a password but for the benefit of others who may read this it's worth re-iterating the point that discussions about how to crack passwords are verboten.

Therefore in the interests of helping you (and maybe others) we've agreed to offer some advice in order that you may consider how to better protect your workbook. The thread is being re-opened on that basis.

The code in the Test sheet can be revealed by first opening the workbook with macros disabled. Then immediately save the file as a .xlsx file and close the workbook. Open the .xlsx file, go into then VBE and set the Visible property of the Test sheet to xlSheetVisible to reveal the code "Kasandra".

Unprotecting the VBE is another matter completely and doesn't lend itself to any standard Excel operations that I know of.

I guess I would be breaching forum rules if I told you how I got this ...

Please Login or Register  to view this content.

And (most of) the Workbook_Open code ...

Please Login or Register  to view this content.

Needless to say, Excel is not a secure environment. If your desire is to protect the code against accidental or intentional interference, it's probably good enough. However, if it is intended to protect against someone who want to steal the proprietory information/code, it doesn't present much of a barrier.

To follow up on Kyle's comments, my research on Third Party Excel protection products would lead me to believe that they are expensive, complex and limiting in what you can and cannot do. They typically have multiple user licensing agreements that could prove to be very expensive depending on the size of the organisation and/or number of people needing to use the protected workbook(s).

I once saw a review of several products and none came out well. However, a) I can't find it and b) it would be relatively old now. If you did want to go down that track, I would urge you to download a trial version of the product and see how well it meets your needs. I did trial Spreadsheet Sentry some time ago and it seemed to work but the client decided not to use it ... probably a licensing issue.

@Kyle: if you've got it, flaunt it .

Just something I invested in a long time ago and it still seems to work quite well ... at least with VBA/VBE protection.

That was fun... had never tried this before but it is surprisingly easy to just change the VBA Project password and get to the code. I knew sheet protection was easy of course, but had no idea how useless the project protection is for a user with moderate abilities. Once in the code it is of course simple to just get or change the required password for "Test"

This was a very interesting discussion. My understanding is that Microsoft strengthened its protection in Excel 2013. Would anyone be able to comment if this is true and if so, how much stronger did the protection become? Many thanks.

My understanding was that they changed the algorithm that protects the password making it more difficult to crack. This is noticeable when using a macro to protect and unprotect a sheet using a password in Excel 1213. The macro takes longer to run particularly if you want to loop through all the sheets.

To quote John Walkenbach:

Spreadsheet Protection FAQ

If I protect my worksheet with a password, is it really secure?
No. Don't confuse protection with security. Worksheet protection is not a security feature. Fact is, Excel uses a very simple encryption system for worksheet protection. When you protect a worksheet with a password, that password -- as well as many others -- can be used to unprotect the worksheet. Consequently, it's very easy to "break" a password-protected worksheet.

Worksheet protection is not really intended to prevent people from accessing data in a worksheet. If someone really wants to get your data, they can. If you really need to keep your data secure, Excel is not the best platform to use.

So are you saying that protecting a worksheet is pointless?
Not at all. Protecting a worksheet is useful for preventing accidental erasure of formulas. A common example is a template that contains input cells and formulas that calculate a result. Typically, the formula cells would be Locked (and maybe Hidden) the input cells would be Unlocked, and the worksheet would be protected. This helps ensure that a novice user will not accidentally delete a formula.

Are there any other reasons to protect a worksheet?
Protecting a worksheet can also facilitate data entry. When a worksheet is locked, you can use the Tab key to move among the Unlocked cells. Pressing Tab moves to the next Unlocked cell. Locked cells are skipped over.

I can't believe that the algorithm has changed but it would be interesting to try to crack the password from a worksheet protected in Excel 2013 or above. That said, I suspect the slower performance is related more to innate inefficiencies in later versions of Excel. Other things perform much worse, for example, Conditional Formatting can be a nightmare.

And ... here's the apology

http://www.thespreadsheetguru.com/bl...ty-methodology

This explains how the hashing algorithm has changed and improved so the old password macros won't work. However, it must be noted that the level of protection depends on the version of Excel where the password is applied. So, if you protect a sheet in Excel 2013 and then Unprotect and Reprotect in Excel 2010 or earlier, you end up with old style password protection.

By applying a very messy "Spaghetti" Coding, With another Workbook for your own use as copy for clarification, you could throw the less knowledgeable "thief" well of balance, and hopefully incapable of making any sense of what the heck it is.

Thank you, TMS, for the link. It provided some very interesting and useful information.