I'm sure the world will be shocked to learn that Microsoft's implementation of protecting Excel worksheets and workbooks may be... uhh... lacking in security. I needed to make a modification to a protected workbook (for extremely practical and entirely wholesome reasons), so I figured that I would see what it would take to figure out or find the password. Well not much, it turns out. I viewed the document using "less" in a terminal and near the end (always look there first) there's a section of code-like string fragments having to do with protecting and unprotecting, and nestled nearby was a short string that didn't make sense as code, didn't make sense as any kind of Excel keyword, and was not contained in the visible Excel workbook text.
So I tried unprotecting the workbook with that string as the password. Yep, that did it. Now I'm sure it was implemented that way so that the average human who forgets a password ten minutes after thinking it up wouldn't be completely stuck. But those kinds of "failsafes" are usually just wide open back doors. Definitely the case here.
No doubt thousands of other people figured this out long ago, but it was amusing to me.
Recent Comments