Protected Sheet Hacked

[bradgar]

I have a program that depends on VBA and cell formulas that I send to customers for projections. We do not want them to have access to either the formulas or the VBA. I feel the VBA is safe (enough) with password protection.

However, even with sheet protection, one of our customers sent back a workbook in which they had unprotected one sheet. Our password is not a simple one. Thus, I searched Google to see how they did this and the first result gave me some VBA that I was able to replicate what they had done. Because my VBA is well protected I was still able to open a new workbook and call on my protected one to unprotect the sheet (and any sheet) with a generic password.

Is there anyway to avoid this "hack" to my workbook?

P.s. I really don't want to post the password break code here because I don't want to propagate this type of coding. Especially since I love this forum.

 

[JoeMo]

I have a program that depends on VBA and cell formulas that I send to customers for projections. We do not want them to have access to either the formulas or the VBA. I feel the VBA is safe (enough) with password protection.

However, even with sheet protection, one of our customers sent back a workbook in which they had unprotected one sheet. Our password is not a simple one. Thus, I searched Google to see how they did this and the first result gave me some VBA that I was able to replicate what they had done. Because my VBA is well protected I was still able to open a new workbook and call on my protected one to unprotect the sheet (and any sheet) with a generic password.

Is there anyway to avoid this "hack" to my workbook?

P.s. I really don't want to post the password break code here because I don't want to propagate this type of coding. Especially since I love this forum.

Your experience emphasizes that Excel's password protection is not a foolproof security measure. If the user must have access to the particular sheet in question, I know of no way to circumvent the problem you encountered. If the user does not need access to the sheet, consider making the sheet xlVeryHidden.

 

[Michael M]

Further to Joes comments.
Excel security is very weak, even the VBE can be cracked with little effort.
However, sometimes the simplest little tricks, work the best.
I had similar issues, with one of my co workers, but by simply making all font the same color as the cell interior then making row height 0.1, the problem was solved.
The co worker even rang me to ask how I did it !!!

 

[jasonb75]

Given that you had to open a new workbook to hack the protected one, could you use workbook activate to reapply the protection when they return to the protected file?

How does excel behave if you try to apply the protection in this way when the protection is already active, does it error?

 

[Chrisdontm]

Wold it work if you just sent them a picture of the document and some squares to the side for them to enter details that you need to formulate results...?
( I hope I said all that right )

 

[mikerickson]

Software based security doesn't really protect against bad guys.
But your customer isn't really a bad guy.

Have you considered making the sheet veryHidden and letting it go at that?

You can spend your time on keeping secrets or on making the program run better.

 

[bradgar]

Wow! Thank you all very much for your replies!

Joe: Fortunately, most of the important things are on xlVeryHidden sheets. However, the customer needs the other sheets to use the program (we provide it free with our products).

Michael: These are the input and output sheets for the projection, again I can't do any trickery like this; also, unhappy to hear that there is also poor security for the VBE/VBA-side.

Jason: I like your idea about trying this on either the workbook activate or even sheet activate side! May be worth a try and my time.

Chris: Can't send pictures etc., the program is really for them and they need all of its' functionality.

Mike R: Very true! I know my customer isn't a bad guy, we simply don't want them to be able to change our projections and make false-claims about what our products are capable of doing or making their own program using our formulas/algorithms.

So thank you all again, but I think I'll give what Jason was saying a try (hoping they haven't accessed the VBE/VBA part) and update you guys later on my success (or lack thereof). Again and along the lines of what Mike R. said, my customer isn't a bad guy. I can only try my best to keep us all out of harms way in the form of misleading calculations for the end-user (my customers customer).

Cheers!

 

[bradgar]

Well Thanks to Jason for a great idea. Here's what I put on each sheet:

Private Sub Worksheet_SelectionChange(ByVal Target As Range)


    If ActiveSheet.ProtectContents = False Then
        MsgBox ("You are not authorized to unlock this sheet." & Chr(13) & Chr(13) & "You will now be exited from the Program and it will be reset!"), vbCritical, "Unauthorized Access"
        If ActiveWorkbook.ReadOnly = False Then
            ActiveSheet.Protect 'hidden
            ActiveWorkbook.Save
        End if
        ActiveWorkbook.Close False
        
    End If


End Sub

It's also in the Worksheet_Activate() module (same code), and I left some things out as well. This way if they do get in, and they don't trigger the worksheet activate, once they change to a different cell it will kick them out. It may not be 100% protected but I think this is enough to deter them from doing it.

Thanks again to all for your help, suggestions, & advise!