[Mimedefang] Checking Office XML Files

[Kevin A. McGrail]

Morning!

I have previously been checking files like xlsx for indicators they have
macros and blocking them.

Effectively I was doing things like this by treating them as zip files.

However, it appears I was stupid and files when password protected
aren't password protected zips but something else.

I'm just starting to dive into this issue.

Any ideas how to reliably detect if they are password protected Office
files and deal with them appropriately? A quick check shows they don't
appear to have a consistent magic byte but perhaps I'm missing something
obvious.

Regards,
KAM
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpengui

[Dianne Skoll]

On Thu, 13 Apr 2017 07:15:24 -0400

Post by Kevin A. McGrail
Any ideas how to reliably detect if they are password protected
Office files and deal with them appropriately?

:) Funny you should ask! We do this in CanIt.

There's a program called "lsar" that can print out all kinds of useful info
about all kinds of archive formats, including MS Office files. Some encrypted
office files contain a subfile called "EncryptionInfo" while for others,
"lsar" issues an "XADIsEncrypted" attribute.

So you can key off those.

On Debian, "lsar" is part of the "unar" package.

Regards,

Dianne.
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefan

[Kevin A. McGrail]

Post by Dianne Skoll
On Thu, 13 Apr 2017 07:15:24 -0400

Post by Kevin A. McGrail
Any ideas how to reliably detect if they are password protected
Office files and deal with them appropriately?

:) Funny you should ask! We do this in CanIt.
There's a program called "lsar" that can print out all kinds of useful info
about all kinds of archive formats, including MS Office files. Some encrypted
office files contain a subfile called "EncryptionInfo" while for others,
"lsar" issues an "XADIsEncrypted" attribute.
So you can key off those.
On Debian, "lsar" is part of the "unar" package.

We are on similar pages there.

lsar does indeed identify it correctly.

It was really my mistake thinking that all office xml (docx, xlsx, etc)
were zip files.

It appears encrypted ones are not!
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/li