Is a DEcompiled ACCDB still DEcompiled after signing? (1 Viewer)

[AHeyne]

The Microsoft Office Subject Interface Packages for Digitally Signing VBA Projects (https://www.microsoft.com/en-us/download/details.aspx?id=56617) sounded very interesting, but unfortunately it seems not to support Microsoft Access:

SUPPORTED FILE FORMATS

    MSOSIP:
        Excel: .xla, .xls, .xlt
        PowerPoint: .pot, .ppa, .pps, .ppt
        Project: .mpp, .mpt
        Publisher: .pub
        Visio: .vdw, .vdx, .vsd, .vss, .vst, .vsx, .vtx
        Word: .doc, .dot, .wiz

    MSOSIPX:
        Excel: .xlam, .xlsb, .xlsm, .xltm
        PowerPoint: .potm, .ppam, .ppsm, .pptm
        Visio: .vsdm, .vssm, .vstm
        Word: .docm, .dotm

Also in the binary "msosipx.dll" I couln't find any occurrences of the strings "accdb" or "accde" (whereas I was able to find "vsdm" or "docm").

 

[isladogs]

I hadn’t seen post #21 when I wrote this.
I have now successfully added a timestamp to a file signed with a self cert. As that is valid until 2031, I have no means of checking it remains valid after expiry.

However, as you have a valid certificate, you could easily test for yourself by downloading a trial version of 365 which will be valid for 30 days. Any files you sign will remain signed even if you cancel the 365 trial

 

[isladogs]

@AHeyne
Following on from post #22, I have been in discussion with both @sonic8 and the Access team regarding timestamping a VBA project and run a number of successful tests.

I can confirm that:

• By default, a timestamp is NOT added when a VBA project is signed
• The addition of several registry keys to HKCU\SOFTWARE\Microsoft\VBA\Security will cause a timestamp to be added when signing a project either from the VBE or using the new /sign command line switch.
• This functionality was added by another Office team towards the end of 2024
• Full details of the steps needed are in a MS help article: https://support.microsoft.com/en-us...-project-956e9cc8-bbf6-4365-8bfa-98505ecd1c01
• I have also written this up with additional info in a new article on my website: https://www.isladogs.co.uk/code-sign-timestamp/index.html

Thank you for raising the issue of timestamping.
I had previously thought it wasn't possible and knowing that it can be done has the important outcome that a digital signature with a timestamp will remain valid even after the certificate has expired.
For those who use certificates, this is good news and a very big issue!

 

[AHeyne]

Thanks a lot for this validated information, @isladogs , @sonic8 and the Access team!

The only 'problem' is that it is estimated that only around a third of our customers use Access 365, the rest use the still supported versions 2016 - 2024. Unfortunately, they cannot verify a certificate.

But overall, this is a big step in the right direction, and time is playing in our favor.