An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#52448 - 09/14/19 03:01 PM Pondering Office 19
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
I’ve been musing about my Microsoft Office apps since receiving (a while back) advice from Microsoft that they would no longer support Office 11 or earlier. According to the “About” information, my latest installed update is Office 11 Version 14.7.7 (170905). Note: Since the caution from Microsoft, they have actually sent a couple of updates.

I only have Excel, Word and Powerpoint., and I mostly use Excel and Word for basic writing and spreadsheet functions with Powerpoint periodically pulled out when someone sends a PP document. Otherwise, I have no requirement for all the enhancements that would come with the “latest, greatest….blah, blah, blah” version such as Office 2019.

However, my musing is about security. Will I be less vulnerable with Office 2019, given it will be sending security updates? Or can I assume that any holes in Office 2011 have been plugged by now and that the chances of something sneaking in are slim?

Going to Office 19 is not cheap. $150 Canadian.


Edited by ryck (09/14/19 03:05 PM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS Mojave 10.14.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 1TB LaCie USB-C
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#52449 - 09/15/19 05:20 AM Re: Pondering Office 19 [Re: ryck]
joemikeb Offline
Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
There are holes that are as yet undiscovered, unrecognized, ignored or the fix was or will be made only to future generations of Office. So the upgrades are important.

Consider this, Pages (not my favorite Word Processor, but adequate) will open edit and save well over 90% of Word documents, likewise Numbers can handle all but the most sophisticated Excell spreadsheets, and Keynote (which I greatly prefer to Powerpoint can handle most Powerpoint files. All of these apps are FREE from the App Store and could very likely handle everything you have described. Certainly they are worth considering. If you simply hate the Apple apps OpenOffice/NeoOffice/LibreOffice is equally adept at handling Office files and they too are FREE.
_________________________
joemikeb • moderator

Top
#52450 - 09/15/19 09:44 AM Re: Pondering Office 19 [Re: joemikeb]
artie505 Online


Registered: 08/04/09
I've always kept Excel (the only Office app I use) up to date, but hand in hand with that, I've always wondered what security vulnerabilities could exist in an app that's neither connected to the Internet nor generating files that I intend to transmit over it.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#52451 - 09/15/19 12:11 PM Re: Pondering Office 19 [Re: artie505]
joemikeb Offline
Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
Originally Posted By: artie505
I've always kept Excel (the only Office app I use) up to date, but hand in hand with that, I've always wondered what security vulnerabilities could exist in an app that's neither connected to the Internet nor generating files that I intend to transmit over it.

The prime danger is NOT in connecting the app to the internet or generating files you intend to transmit over it. It lies in opening files you have received over the internet that contain exploits which can take advantage of vulnerabilities in the app to expose your system to a rich variety of exploits.

Because Office apps contain their own scripting language Visual Basic for Applications (VBA) they have been used to disseminate malware if not being malware themselves. Needless to say Windows is most vulnerable to such Office exploits, but there have been at least attempts at exploits that might attack MacOS as well.
_________________________
joemikeb • moderator

Top
#52452 - 09/16/19 03:10 AM Re: Pondering Office 19 [Re: joemikeb]
artie505 Online


Registered: 08/04/09
Thanks for the explanation.

So the bottom line for me is that since I never receive Office files other than from my daughter - the one who likes me tongue - and regardless of that, I"ve got "Disable all macros..." set in prefs, I don't really need to run Office security updates.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#52453 - 09/16/19 05:11 AM Re: Pondering Office 19 [Re: artie505]
jchuzi Offline


Registered: 08/04/09
Loc: New York State
I can think of one caveat: Although you trust your daughter, she may be sending a file that she received from another source, one that may not be entirely kosher.

Just a thought...
_________________________
Jon

OS 10.14.6, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365

Top
#52454 - 09/16/19 05:24 AM Re: Pondering Office 19 [Re: jchuzi]
artie505 Online


Registered: 08/04/09
The thought's a good one and is appreciated, but she sends me only files that she's created herself.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#52455 - 09/16/19 06:35 AM Re: Pondering Office 19 [Re: joemikeb]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: joemikeb
The prime danger is NOT in connecting the app to the internet or generating files you intend to transmit over it. It lies in opening files you have received over the internet that contain exploits which can take advantage of vulnerabilities in the app to expose your system to a rich variety of exploits.

My Word and Excel Security preferences windows have a choice: “Warn before opening a file that contains macros or customized toolbars, menus or shortcuts”, which I have checked off. It states that I would be given the choice to disable macros. Powerpoint doesn’t have a Security preferences window but, under General preferences, has “Enable macro virus protection”, also checked off.

The VBA link says: “End-users can protect themselves from attack by disabling macros from running in an application or by granting permission for a document to run VBA code only if they are sure that the source of the document can be trusted.”

Is it reasonable to assume that the above protections will continue to be okay, or is there a worry that someone will be motivated enough to write code bypassing the Preferences?

Like artie, the bulk of Word documents I receive are from a daughter. She is always the original author of the dox and they will go back and forth in a joint editing process. Periodically I'll receive a Word document from an acquaintance who most likely is sending Word because they don't know how to convert to a PDF. Needless to say, neither would they have any idea how to create a macro.


Edited by ryck (09/16/19 06:47 AM)
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS Mojave 10.14.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 1TB LaCie USB-C
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#52456 - 09/16/19 06:49 AM Re: Pondering Office 19 [Re: artie505]
joemikeb Offline
Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
My daughter too is entirely trustworthy, but her middle school aged son although smart and well meaning is not particularly wise. So God only knows what gets into my daughter's Mac from her son's school.

Ponder this scenario:
  1. Your daughter receives a file from one of her friends which contains malware that infects your daughter's computer but she is unaware of the infection because the malware is new and its signature is as yet unknown.
  2. Your daughter creates a new Office file entirely on her computer, but the malware infection sneakily inserts itself into the Office file
  3. Your daughter sends the file to you and your anti-malware app does not recognize it for the same reasons you daughter's computer don't.
  4. Because your Office version is not up to date the malware is able to infect your computer.
  5. six months later there is a knock on your door and you open it to be presented with a warrant for your arrest for distributing porn and the evidence is found on your computer
It has happened in the PC world and could happen in the Mac world if you become too complacent. The bad guys depend on two things for their success, cupidity and complacency.
_________________________
joemikeb • moderator

Top
#52457 - 09/16/19 07:00 AM Re: Pondering Office 19 [Re: joemikeb]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Excellent points....and they certainly underline Jon's musing about another source. Thank you both.

What about a case where the malware originates in a system like Windows? That is, the originator created the document on a Windows machine where an infection has snuck in, and the document is then opened in the Mac version of Word. Is that malware going to be executed on the Mac and, even if not, can it somehow be a pain in the rear just due to its presence?
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS Mojave 10.14.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 1TB LaCie USB-C
Carbon Copy Clone on 500GB OWC Mercury OTG Pro

Top
#52458 - 09/16/19 08:07 AM Re: Pondering Office 19 [Re: ryck]
joemikeb Offline
Moderator

Registered: 08/04/09
Loc: Fort Worth, Texas
Originally Posted By: ryck
What about a case where the malware originates in a system like Windows? That is, the originator created the document on a Windows machine where an infection has snuck in, and the document is then opened in the Mac version of Word. Is that malware going to be executed on the Mac and, even if not, can it somehow be a pain in the rear just due to its presence?

A VBA macro is platform independent. In other words it can run on Mac or Windows. Whether it can actually infect the Mac or not, depends on the inventiveness of the malware writer. It could...
  • have no effect on the Mac
  • have no effect on the Mac per se but infect other Office files and thereby be in a position to being passed along to Windows users the Mac user might share files with.
  • Import a piece of malware from the internet that could infect the Mac.
  • be very annoying when using Office apps
  • might not be a VBA Macro at all but an executable that runs when the file is opened and is unaffected by preventing Macros from running.
THE FACTS ARE:
  1. VBA macros are "old school" malware technology but there are still exploits in the wild which still constitute a risk,
  2. this is NOT the distribution vector used by the latest and most destructive malware.
  3. the latest and most destructive exploits are distributed using "human factors engineering" tactics that rely on human cupidity, gullibility, and complacency.
  4. any vulnerability in the hardware, OS, or apps can be exploited in ways that most of us could or would never envision.
  5. the best anti-malware apps can do is detect the digital signature of KNOWN malware
  6. the best protection against malware is threefold
    1. Keep the OS and apps scrupulously up to date
    2. Remain suspicious at all times and always err on the side of caution.
    3. Never become complacent
  7. While Catalina's plethora of "Do you want to grant…" questions and frequent trips to System Preferences > Security & Privacy > Privacy to grant apps access to specific resources can be annoying they do accomplish the goal of making the user THINK about what they are doing.
  8. You are better off safe than sorry.
_________________________
joemikeb • moderator

Top
#52459 - 09/16/19 09:11 AM Re: Pondering Office 19 [Re: joemikeb]
ryck Offline


Registered: 08/04/09
Loc: Okanagan Valley
Thank you for taking the time to provide, once again, an extremely complete and easy-to-understand reply. However, you probably forgot to say to yourself: “Wait. This is ryck and he’s sure to ask another question.” Yup.

Originally Posted By: joemikeb
  • THE FACTS ARE:
      [*]the best anti-malware apps can do is detect the digital signature of KNOWN malware [*]the best protection against malware is threefold
      1. Keep the OS and apps scrupulously up to date
      2. Remain suspicious at all times and always err on the side of caution.
      3. Never become complacent

  • Got it…..and my wife and I have had suspicion as our watchword for quite a while. In fact, she’s presently out of town but sent a text yesterday asking me to look at two emails in her account which she wondered about. Sure enough they were phishing expeditions, so I wrote Rules in her Apple Mail that would delete them if they came by again.

    So, returning to the thread question….it looks like upgrading to Office 19 might be prudent.

    Originally Posted By: joemikeb
  • THE FACTS ARE:
      [*]VBA macros are "old school" malware technology but there are still exploits in the wild which still constitute a risk,

  • You also mentioned that the OS should be scrupulously kept up to date. I am at Mojave 10.14.6 and hoping to stay there for a while because, being inflicted with invincible stubbornness, I want to keep certain 32 bit apps. None of them would ever involve sharing or any other usage other than on my Mac. Am I right to assume that, because Office is the only software that has sharing possibilities, my 32 bit apps shouldn’t constitute any great concern?


    Edited by ryck (09/16/19 09:15 AM)
    _________________________
    ryck

    iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
    OS Mojave 10.14.6
    Canon MX710 Printer
    Epson Perfection V500 Photo Scanner
    Time Machine on 1TB LaCie USB-C
    Carbon Copy Clone on 500GB OWC Mercury OTG Pro

    Top
    #52460 - 09/16/19 10:49 AM Re: Pondering Office 19 [Re: ryck]
    joemikeb Offline
    Moderator

    Registered: 08/04/09
    Loc: Fort Worth, Texas
    Originally Posted By: ryck
    You also mentioned that the OS should be scrupulously kept up to date. I am at Mojave 10.14.6 and hoping to stay there for a while because, being inflicted with invincible stubbornness, I want to keep certain 32 bit apps. None of them would ever involve sharing or any other usage other than on my Mac. Am I right to assume that, because Office is the only software that has sharing possibilities, my 32 bit apps shouldn’t constitute any great concern?

    Your principle concern should be Mojave and how long Apple will continue to provide security updates to it. Generally apps whether 32 bit or 64 bit are neither the target or vector of Malware. The Office apps are an exception because of their VBA macro capability and their wide distribution. The prime sources of infection are
    • Malware installed by the user (which is a dissertation of its own)
    • Infected emails
    • any kind of file downloaded from the internet
    • bots hacking into poorly protected computers
    • text messages (I haven't heard of any specific exploit of this type but with animated texts it should be possible)
    You mentioned the possibility of upgrading Office but once again I should point out there are FREE or low cost alternatives that do an adequate job of handling all but the most complex Word, Excel, and Powerpoint files.
    _________________________
    joemikeb • moderator

    Top
    #52461 - 09/17/19 12:24 AM Re: Pondering Office 19 [Re: joemikeb]
    artie505 Online


    Registered: 08/04/09
    Thanks for the excellent posts; they're certainly food for thought (but whether it's productive thought is a-whole-nother matter).

    I tried Numbers once and just plain didn't like it, but I guess it won't hurt to give it another chance when Microsoft stops supporting Office 2016.

    (You're our resident doom and gloom/worst case scenarios expert, but I must concede that it doesn't hurt us to have one. smile )
    _________________________
    The new Great Equalizer is the SEND button.

    In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

    Top
    #52462 - 09/17/19 06:47 AM Re: Pondering Office 19 [Re: artie505]
    joemikeb Offline
    Moderator

    Registered: 08/04/09
    Loc: Fort Worth, Texas
    Originally Posted By: artie505
    (You're our resident doom and gloom/worst case scenarios expert, but I must concede that it doesn't hurt us to have one. smile )

    That doom and gloom scenario is the result of a member of my family having been hit for several tens of thousands of dollars in fraudulent charges and another being hit with a ransomware exploit that had him locked out of his business computer (the Apple Store fixed that one without financial loss however). Not to mention the $10,000 first class airline tickets I supposedly bought from Dubai to Berlin or the $500 worth of makeup my wife purchased at an Ulta store in a place she had never been. It can and does happen.
    _________________________
    joemikeb • moderator

    Top
    #52463 - 09/17/19 03:45 PM Re: Pondering Office 19 [Re: joemikeb]
    artie505 Online


    Registered: 08/04/09
    Ouch! frown
    _________________________
    The new Great Equalizer is the SEND button.

    In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

    Top

    Moderator:  alternaut, dianne, dkmarsh