Hacker News Reader

Such a thing is likely to happen but it is much more target specific (e.g. my office backs up data, not code, so you would have to find something scripted that’s in use for that to work on my office) so it will likely happen only if the Low hanging fruits (generic attacks that need much less customization) aren’t lucrative anymore.

View on HN

> my office backs up data, not code

No user's apps? No Registry? Ok, sneak it in Word document then. This delay thing can be applied wholesale, not targeted.

everything is backed up for reference, but only data is ever restored.

Macro execution is supposed to be disabled on Word/Excel, though I trust that less (and there’s always the issue of some unpatched/zeroday); however, to go through here is more expensive for attackera because much more individual targeting and customization is required.

Good practice. I'm just playing around, devil's advocate.

It is difficult to imagine people who are heavy Excel users being ok with macros being disabled wholesale.

Indeed, they are not heavy excel users. Which is sort of the point: the need for targeted attacks greatly reduces and segments the addressable “market” for the bad guys.

Nah. Point stands, attack can survive the restore inside Office docs because macros are generally allowed.

Reply on news.ycombinator.com