Changing a query Dynamically (1 Viewer)

Galaxiom

Super Moderator
Staff member
Local time
Today, 13:11
Joined
Jan 20, 2009
Messages
12,852
It is worth mentioning that, though otherwise more secure, adding a digital signature to an ACCDB/ACCDE file has absolutely no effect. To repeat, it does nothing.
See this article by AWF member sonic8: https://codekabinett.com/rdumps.php?Lang=2&targetDoc=signing-vba-code-access-accdb

That article only mentions signing the accdc package. As far as I am aware, there is no way to usefully sign an accde file.

Of course any file can be signed but that is only useful if the application or operating system can be instructed how to react to the signature. Our network admin once experimented turning a Group Policy that prevented unsigned exe files from running. I signed one myself before he abandoned the policy as more trouble than it was worth.

Similarly I could sign an accde but Access probably wouldn't care if the signature was valid or not, if indeed adding the signature didn't stop it working altogether. Then just running the file would cause it to change and invalidate the signature because it applies to the whole file rather than particular sections as happens with signed Office files.

Signed packages and Trusted Locations look like a Claytons security model to me. My understanding is that the signature on a package just allows it to be extracted into a Trusted Location without a warning.

A user can still copy arbitrary files into a Trusted Location where Office will assume they are fine. Unfortunately users need to have write access to the folder to create the lock file when they run the Access file. Otherwise they will probably, at best, get a read only warning.

Which brings me back to where I started with signatures. My primary goal back in the days of Access 2003 was to avoid the startup warning. I wasn't actually that concerned about security per se.
 

isladogs

MVP / VIP
Local time
Today, 04:11
Joined
Jan 14, 2017
Messages
18,221
Thanks Greg

I no longer sign Access files myself but hopefully Phillip Stiefel (sonic8) will see and possibly respond to this thread
 

sonic8

AWF VIP
Local time
Today, 05:11
Joined
Oct 27, 2015
Messages
998
That article only mentions signing the accdc package. As far as I am aware, there is no way to usefully sign an accde file.
Well, the article describes what you end up with when following the documentation on "Signing your database". - And, yes, that is effectively creating and signing an AccDC package.

Beyond that, I agree with your assessment of the current options for signing Access files and do not have anything to add. :-/
 

The_Doc_Man

Immoderate Moderator
Staff member
Local time
Yesterday, 22:11
Joined
Feb 28, 2001
Messages
27,185
adding a digital signature to an ACCDB/ACCDE file has absolutely no effect.

This is in fact a basic security concept. One of the reasons that .MDx and .ACCDx files are less than perfectly secure is that the putative hacker doesn't play by the rules.

It has long been known that when you lock something, you do so by using a particular type of system call. Hackers, because they use backdoors and such, never go through the system routine that would normally check for locks. If your hacker had a way to determine a physical block address on a disk and had physical I/O capability (which is one of the things hackers commonly get), THERE ARE NO LOCKS.

Therefore, when someone puts a digital signature on something, that only tells the FILE system that a signature exists. In this case, Access doesn't care so doesn't honor the implications of the signature or test the file for tampering.

It is important, therefore, to realize that methods used to secure a database only work for those people who play by the rules. For people to whom rules are at best speed bumps along the road, they will drive in that Mack truck and abscond with all your data pretty much at leisure. Which is why encryption and other obscuration methods are so important if you have critical data.
 

Galaxiom

Super Moderator
Staff member
Local time
Today, 13:11
Joined
Jan 20, 2009
Messages
12,852
Signatures were never intended to secure the data. Their purpose is solely to validate that the file has not been tampered with since having an authorised signature applied.

They are used in conjunction with system settings that prevent the running of unsigned applications or applications where the signature does not match the content, depending on the settings.

In the case of Office documents it prevents users inadvertently opening files that may contain malicious macros.
 

Users who are viewing this thread

Top Bottom