Concerning: password-protection disappeared from sensitive Excel file

[d0rian]

I set a "password-to-open" security requirement for a file that I created years ago, and I've always been prompted for the password to open it. I just recently noticed that I could open it WITHOUT a password. Rebooted to make sure it wasn't some weird memory thing, and sure enough, the password requirement seems to have been completely removed.

I actually save a backup of the file a few times / week, and noticed that the Dec 20th backup DOES still have the password requirement, but the Dec 24th backup does NOT.

So somewhere in those 4 days, the password requirement got stripped away. But to the best of my knowledge, that can only be done via the small Tools... dropdown in the Save As window, which I 100% have not used.

Has anyone encountered something like this before? I'm concerned, although virus scans on my machine come up clean...

[FDibbins]

Password protection in excel is not that good, anyone who knows their way around can by-pass it.
Is it possible someone has cracked your P/W?
What happens if you re-apply the PW?

[d0rian]

Password protection in excel is not that good, anyone who knows their way around can by-pass it.
Is it possible someone has cracked your P/W?
What happens if you re-apply the PW?

1. What do you mean "knows their way around"? That doesn't sound very promising...absent a keylogger of some sort, how are you saying it could be defeated?
2. Possible, but this is a private computer that only I have access to.
3. I did re-save it with password, and now it prompts for password on open, as it always had (before ceasing to do so this past week). So it's once again "secured", but i'm still concerned about why the password-protection would have disappeared seemingly on its own...want to be sure my security hasn't been compromised.

[FDibbins]

1. What do you mean "knows their way around"? That doesn't sound very promising...absent a keylogger of some sort, how are you saying it could be defeated?

there are ways for excel-savy experts to get past password security in minutes (seconds maybe). excel's security is notoriously weak

3. I did re-save it with password, and now it prompts for password on open, as it always had (before ceasing to do so this past week). So it's once again "secured", but i'm still concerned about why the password-protection would have disappeared seemingly on its own...want to be sure my security hasn't been compromised.

Keep am eye on it for a while.

I will also push this to the other experts for their input

[FDibbins]

1. What do you mean "knows their way around"? That doesn't sound very promising...absent a keylogger of some sort, how are you saying it could be defeated?

there are ways for excel-savy experts to get past password security in minutes (seconds maybe). excel's security is notoriously weak

3. I did re-save it with password, and now it prompts for password on open, as it always had (before ceasing to do so this past week). So it's once again "secured", but i'm still concerned about why the password-protection would have disappeared seemingly on its own...want to be sure my security hasn't been compromised.

Keep am eye on it for a while.

I will also push this to the other experts for their input

[d0rian]

there are ways for excel-savy experts to get past password security in minutes (seconds maybe). excel's security is notoriously weak

I'm still not sure what this means...are you talking just a brute force thing? Are there widely-available cracking tools? I don't doubt that Excel's password-security isn't military-strength, but I'm not sure just what you're implying here.

Keep am eye on it for a while.

What do you mean "keep an eye on it"? What am I looking for? Keep in mind, I'm not necessarily alleging that someone has stolen the data from this file...although that very well may have happened. Rather, I just want to know whether there's some Excel bug, or perhaps a routine action that a user like me may have unwittingly taken that would "turn off" the password-security for a previously-protected file. Because the only way I know of doing that involves drilling down into the Tools...Security menu that I 100% did not do. And I also def did not Save As... a new/different version of the file, which I guess also could have saved a a non-password-protected version of it...

[Logit]

dOrian:

There are not many options left if you didn't delete the password or save the file as new. If the file has been available to others, it would seem someone other than you changed / deleted the password. I've seen Excel do some
interesting things on it's own with my projects but not delete code on it's own.

Removed by Admin, we dont allow discussions on how to bypass secuity

There are code snippets, compiled programs, and written instructions all over the place allowing anyone to break Excel's security. Rather depressing .... if security is valued.

[FDibbins]

dOrian: Im not sure how else to say this, other than perhaps - excel security is crap

I have never heard of excel just "dumping" it's PW, I meant, just keep aware to see if this happens again

[TMS]

The password protection in Excel that is crap is, historically, workbook, worksheets and VBA Project level. That was always relatively easy to remove, especially Worksheet protection. And, with a third party application, it could be removed in seconds, if that.

However, "a password to open" was always more difficult. I don't see how it could just "fall off". I can only think that you, or someone who has access to the workbook, removed it, or maybe did a SaveAs without the protection.

[Aardigspook]

I assume you didn't add anything else in the file around that time which might have done the 'Save As' automatically, without the password (for example, trying out some new code which had a save embedded in it)?

[d0rian]

It just happened again. As noted ITT, I'd re-added the Password-to-open security yesterday, and it was properly prompting me for a password...and just now, I closed and re-opened Excel and boom: no password needed, the file just opened. Rebooted the computer to try it again upon a fresh boot-up and the password requirement seems to have been completely removed. I've RE-saved it with the Password-to-open security (which is working for the time being), but now I'm definitely concerned about what's going on. I haven't done ANYTHING out of the ordinary (e.g. trying out new VBA, macros, etc); if anything, I've been extra-vigilant given my existing attempts to understand what's been going on.

Racking my brain, and have no idea what's going on here. The ONLY thing that's at all different is that I'm connected to a new (albeit trusted) wifi network (g/f's family's wifi / secured with WPA2). I have no reason to think it's not secure...

In any case, given that I've just noticed this again right now, is there ANYthing I can do to further investigate just what's going on?

[Aardigspook]

A few things I can think of to investigate further, in an attempt to narrow it down:
1 - are other pw-protected files affected the same way? (If you don't have any others, make a few just for monitoring purposes.)
2 - if you re-name the file but otherwise leave it alone, does this still happen?
3 - a bit of a chore, but can you check all your backup files to see if any others have had the pw requirement removed? If so, is there any pattern to the dates (day of month, day of week, etc)? (You may wish to take copies of those backups before checking them, just in case - depending on how concerned you are about them being affected by being opened.)
4 - have a look at the 'date modified' and 'date last saved' properties through Windows Explorer (also 'date accessed' if you want to be extra thorough) - do the dates/times there match when you know you last modified/saved/accessed the file(s)?

I realise that (1) and (2) require that the 'event,' whatever it is, happens again - but that's all I can think of to do for now, sorry.

[TMS]

And, maybe save the file with a different password to open ... in case someone else, or some code, is using the password.

[Logit]

d0rian

Please keep us updated. This is a strange event and worth knowing more about.

Thanks.

[d0rian]

A few things I can think of to investigate further, in an attempt to narrow it down:
1 - are other pw-protected files affected the same way? (If you don't have any others, make a few just for monitoring purposes.)
2 - if you re-name the file but otherwise leave it alone, does this still happen?
3 - a bit of a chore, but can you check all your backup files to see if any others have had the pw requirement removed? If so, is there any pattern to the dates (day of month, day of week, etc)? (You may wish to take copies of those backups before checking them, just in case - depending on how concerned you are about them being affected by being opened.)
4 - have a look at the 'date modified' and 'date last saved' properties through Windows Explorer (also 'date accessed' if you want to be extra thorough) - do the dates/times there match when you know you last modified/saved/accessed the file(s)?

I realise that (1) and (2) require that the 'event,' whatever it is, happens again - but that's all I can think of to do for now, sorry.

1 - I have a half dozen other Excel files that are password-to-open protected in the same way (many w/ same pw actually)...I checked and all of them still prompt me for pw upon open (though I don't open / edit them anywhere nearly as frequently as this file.)
2 - I just re-named the file. Will report back if it happens again
3 - I'll do that; I save backups several times / week to Dropbox (the original / one I update is on my hard drive); I moved several of them back from Dropbox to my desktop to check on pw-requirement, and the 12/10 to 12/20 backups all had the pw prompt, but the 12/24 one did not. I have dozens of backups saved prior to 12/10 that I can check...though doubt this will turn up anything, since this is the first time I've ever noticed the pw having disappeared, and it seems to have happened some time between 12/20/16 and 12/24/16)
4 - Yes they match (but are all v recent b/c of my testing/troubleshooting). What I really need is some sort of version / save-history...like seeing what computer accessed or saved versions of the file, and at what time. But I don't think that exists.

[d0rian]

Probably unrelated, but something I've found a little weird: when I open the file in question and then immediately attempt to Close it, it generates the "Do you want to save the changes you made to..." prompt. Why would it generate a prompt suggesting there've been changes made, when I have not actually changed anything...I literally just open the file, don't even move the mouse, then hit ctrl-W to Close the file, and it generates that prompt.

This happens with some other (but NOT ALL) Excel files, and there seems to be no rhyme or reason to which ones generate it and which don't. Like I said, I doubt it's related to the password thing, b/c I've noticed this oddity for several months, never paying much attention to it...and the disappearing pw thing only started happening this week.

[FDibbins]

That could happen if you have any volatile functions like DATE/TIME etc running, or perhaps some code running in the background?