Excel protected workbook appears opaque to virus-scan?

Excel protected workbook appears opaque to virus-scan?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Networking Firewalls    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Excel protected workbook appears opaque to virus-scan? sebthirlway 03-13-2006
Posted by on March 13, 2006, 12:51 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi

I've just developed an Excel workbook with VBA in it, which has been
sent as a questionnaire to c. 400 associates nationwide, as an email
attachment.

Some users are not receiving these emails, because the email scanning
software in their organisation is objecting to the file. Here's part
of a typical automated response from a firewall:

[email]....has not been delivered as it has been classified as
containing encrypted data that cannot be checked using the current
automatic content analysis tools.

The thing is, the file is NOT encrypted. It's a normal .XLS (Excel
2000) file, with some VBA code in it. I've scanned it with McAfee
Viruscan Enterprise here at work, and with AVG at home, with no
problems detected.

The only thing I can imagine the security software objecting to is the
fact that the workbook and worksheets are "protected" with a password.
Now this is _not_ encryption: simply a cosmetic measure that prevents
users from changing certain features of the spreadsheet - anyone can
open the workbook and have a look at everything in it. (To repeat the
point: this is not a password-protected file, which requires a password
to be opened: workbook/worksheet protection is distinct from that).

The sheets are protected for a good reason: when they're filled in and
sent back, they're bulk-imported into a database: any change to the
structure of the spreadsheets would completely mess up the import code.

Has anyone come across a similar problem? Is what's happening maybe
not determined by the particular software these orgs are using, but by
some custom rule the mail-admins might have set up within it? Or does
Excel in fact encrypt .XLS files (or part of them) when you protect a
worksheet and/or workbook? But if it did, surely McAfee and AVG would
have objected to these files, which they don't. My copy of AVG was
last updated yesterday, and as far as I know I haven't customised it by
flicking a "be especially lenient towards .XLS files" switch - so why
are these firewalls rejecting the files?
(maybe I've got the wrong end of the stick on this last point -
corporate-scale email security would tend to be _more_ paranoid than me
as an individual, due to the volume of traffic it handles?).

I have no experience of corporate-scale email setups (except as a
user), so I'm a bit mystified how they work with regard to security.

I don't have a clear picture yet of exactly what software is being used
as the firewall (there are 35 different organisations to contact).
This just seems very strange.

thanks for any ideas


Seb


Posted by Volker Birk on March 13, 2006, 12:59 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
In comp.security.firewalls sebthirlway@hotmail.com wrote:
[sending Excel sheets via E-Mail]
> I have no experience of corporate-scale email setups (except as a
> user), so I'm a bit mystified how they work with regard to security.

Unfortunately, many mail setups in the wild are braindead. Usually, people
don't understand the problems, and for this they don't understand how
to solve them. But all are scared of malware now, especially those who
are using Microsoft Windows.

I think this is the reason for your problems. And because this is a social
problem, I'm afraid to tell you, that there is no simple solution for it.

Yours,
VB.
--
At first there was the word. And the word was Content-type: text/plain

Posted by Somebody. on March 13, 2006, 4:10 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Hi
>
> I've just developed an Excel workbook with VBA in it, which has been
> sent as a questionnaire to c. 400 associates nationwide, as an email
> attachment.
>
> Some users are not receiving these emails, because the email scanning
> software in their organisation is objecting to the file. Here's part
> of a typical automated response from a firewall:
>
> [email]....has not been delivered as it has been classified as
> containing encrypted data that cannot be checked using the current
> automatic content analysis tools.
>
<snip>

> I have no experience of corporate-scale email setups (except as a
> user), so I'm a bit mystified how they work with regard to security.
>
> I don't have a clear picture yet of exactly what software is being used
> as the firewall (there are 35 different organisations to contact).
> This just seems very strange.
>
> thanks for any ideas
>
>
> Seb

You're probably running afoul of several different solutions and there may
be no easy method. You might try posting the file on a website and asking
the user to hyperlink to download it, the http rules may be different from
smtp rules. Otherwise you'll need the fw admins to whitelist your domain or
your email address or something like that, to get the content through.
(which with 35 sites, would be no fun) Unless you can unprotect the content
sufficiently which it sounds like you don't want to do.

-Russ.



Posted by Benno on March 14, 2006, 10:16 am
If you were  Registered and logged in, you could reply and use other advanced thread options
sebthirlway@hotmail.com wrote:

> I've just developed an Excel workbook with VBA in it, which has been
> sent as a questionnaire to c. 400 associates nationwide, as an email
> attachment.
>
> Some users are not receiving these emails, because the email scanning
> software in their organisation is objecting to the file.

> The only thing I can imagine the security software objecting to is the
> fact that the workbook and worksheets are "protected" with a password.
> Now this is _not_ encryption: simply a cosmetic measure that prevents
> users from changing certain features of the spreadsheet - anyone can
> open the workbook and have a look at everything in it. (To repeat the
> point: this is not a password-protected file, which requires a password
> to be opened: workbook/worksheet protection is distinct from that).

The anti virus software or mail filters might not be 'smart' enough to
differentiate a read password from a write password and just block the
whole file outright (our Sophos/MailMarshal combo has this problem).

Remove the password altogether. You will still see emails getting
blocked on the VBA code however.

Similar ThreadsPosted
Excel protected workbook appears opaque to virus-scan? March 13, 2006, 1:17 pm
DashBoard CheckPoint and Excel July 30, 2007, 10:16 am
Fortigate/virusScan May 10, 2005, 4:26 pm
iptable log analysis - LEN property appears twice March 12, 2007, 5:54 am
ZoneAlarm 6 and McAfee VirusScan PC startup problem September 13, 2005, 5:27 pm
Would a firewall have protected Josh Glazebrook from the FBI? September 8, 2007, 4:07 pm
Would a firewall have protected Jammie Thomas from being sued by the RIAA Safenet October 3, 2007, 11:05 am
Stay Protected When Surfing, Brand New Proxy Unblock Myspace, Facebook, Bebo At Work, School and Library! February 3, 2008, 1:49 pm

The site map in XML format XML site map

Contact Us | Privacy Policy