Password To Modify Not Accurate

[Kirbs]

Hi,

I'm asking this question out of curiosity. I just discovered that the Password To Modify feature in Excel accepts other passwords aside from the one I set. One sample that I discovered is that if I set the Password To Modify to "bee", it can be unlocked by the word "bag". Same goes for "555" and "116". Does this mean that the Password To Modify feature of Excel also uses hash equivalents (or similar methods) like the one used for Sheet Protection?

 

[sijpie]

This is very interesting, as it means the protection si quite feeble. I know it can be broken anyway with some tools on the web. But if there are even several options for a password then it is even weaker.

I don't know the ins and outs of hash tables, just that they are used in searches.

 

[Richard Schollar]

I never knew that. That's pretty rubbish protection then.

 

[Kirbs]

Yes, I thought so too. I thought that it's the same with the Password To Open feature wherein you have to enter the exact password.

 

[mvptomlinson]

I'm almost positive that Excel uses hash codes for all protection (read/open/mod/sheet protection/book protection/vba). Which is why it's so easy to break them.

Worksheet/book protection, for example, once implemented is converted to a hash of 16 characters. The first 15 of which are always either "a" or "b", and the 16th character is some other letter/number/symbol. Which narrows the number of available hashed passwords to (2^15)*132 or something like that (assuming 132 letters/numbers/symbols). This number (4,325,376) might seem large, but to any password cracking software on a modern PC will take about a second to figure out.

If it didn't use hashes, or allowed the 16-character hashes to include 132 possible characters at any position, the password would be MUCH stronger (132^16 possible = 8.5*10^33, which would take software an eternity to break at current computational speeds).