Protecting a VBA for Word application

[jimaz]

I have created a VBA application that runs within Word and does "a bunch of stuff" including accessing some databases with confidential data. I must restrict use of the program to a list of authorized users which should be simple enough. However ...

Question: How can I prevent users from looking at the VBA source code and either disabling the authentication checks and/or figuring out the database access credentials? I really want to avoid having to recode in another language.

(I know -- the credentials will not be stored in plain text in the program as strings, we are using a method that is "effective enough" to prevent finding them via a hexdump, but they could determine them by viewing the code.)

Thanks

[lucas]

Sad to tell you that you can't. If you want that kind of security you will have to use a compiled visual basic or .net application.

[jimaz]

Sad to tell you that you can't. If you want that kind of security you will have to use a compiled visual basic or .net application.

(edit) I suppose a better question (for this noob) is how would I then proceed to convert VBA into VB or .Net? (I'll wait for the laughing to subside... I can take it!)
Probably going off-topic, Is there is big curve between VBA and VB? (My primary task with Word is fill in a template document (not a .dot file) with a bunch of info from databases, a lot of the data needs to be munged, I cannot just perform a query and insert the results.)

[Paul_Hossler]

Question: How can I prevent users from looking at the VBA source code and either disabling the authentication checks and/or figuring out the database access credentials? I really want to avoid having to recode in another language



In Word 2007, you can PW protect the VBA project

Probably not Top Secret secure, but good enough to keep the VBA secure for typical applications

Paul

[Paul_Hossler]

And here's a sample DOCM

I don't have 2003 available anymore, so I can't see how that might work

Paul

[macropod]

Hi Paul,

You can PW protect the VBA project in any version of Word, but that protection is easily enough broken.

[TonyJollans]

You can't effectively protect the VBA code, but you could put the code somewhere where only authorised users have access to it - for example in a document in a folder to which only they have access. Or, if that's too involved, just in a password-protected document to which only authorised users have the password. It is worth noting that VBA projects are encrypted along with document content, in Word-2007 format encrypted documents (although not in Word 97-2003 format documents).

[Paul_Hossler]

You can PW protect the VBA project in any version of Word, but that protection is easily enough broken.

I do know that it's not very strong, but it might be good enough to be an easy way to keep out casual snoopers looking for a server password.

A determined snooper could buy a PW Crack program, so if that's a fear, then you're right; VBA protection is not nearly strong enough

All the other alternatives discussed / suggested seem to be more involved or more expensive.

Paul

[macropod]

Hi Paul,

Without going into the details, you don't even need to buy a PW Crack program.

[TonyJollans]

It is the work of moments to break VBA password protection, without any specialist tools, if you know how but, despite the fact that many of us here do know how, it isn't really common knowledge, and it will keep out most casual snoopers - whether that is enough for jimaz's situation, only he can tell us.

[Paul_Hossler]

it isn't really common knowledge


And I hope it stays that way :thumb

Paul

[fumei]

Going back to:

"Probably going off-topic, Is there is big curve between VBA and VB? "

Ummmm, sort of, not really, kind of, but not too bad.

While some adjustments are required (mostly dealing with instances of Word, and some syntax differences), if you have the VBA code well written, it is not THAT hard to make it a compiled DLL via VB.

You can not "convert" your VBA to VB; you will have to write it in VB.

Depending on exactly what you are willing to accept, I agree with Tony that a possible solution is to have parts of your procedures and/or data in other access-controlled files.

However, shrug, it may be that just password protecting the VBA project (at its limited security) will be sufficient. I mean, it really depends on how clever your users are (and possibly how clever they think they are....).