-1

I created an Excel-based POS system. To protect it from being pirated, I put an Activate button that runs a macro that gets the motherboard's serial number and stores it in a cell somewhere in a worksheet. You do this one-time when you install the software in a client's computer (licensed machine).

Then I wrote an event procedure in ThisWorkbook that would get the computer's motherboard's serial number and compare it with the one stored earlier for the licensed machine. If the software was copied and used in another machine, of course there will be no match. The user will be notified by a message that says, "You have installed the program in another computer. For a licensed version, pls. contact blah blah..." When the user clicks the OK button, the workbook will close. The project is locked for viewing.

Thus, once the workbook is locked into the licensed machine and it is copied and used in another computer, the user won't be able to open the workbook.

Is there a way for hackers to get past my security procedure? If so how and how can I stop them? What other ways can I do to prevent others from pirating my software? Thanks.

Here is the code:

Private Sub Workbook_Open()

Dim LicensedMachine As String

LicensedMachine = Sheet1.Range("Z102") ''This is where you have already stored licensed machine's motherboard s.n.

If MBSerialNumber <> LicensedMachine Then   ''Call function and check if current machine's motherboard s.n. matches the licensed machine's.
    MsgBox Title:="EXCEL POS", Prompt:="You have installed program in another computer." & vbCrLf & _
    "Contact R House at 0917-555-1234 or [email protected] for licensed copy.", _
    Buttons:=vbExclamation
    ActiveWorkbook.Save
    ActiveWorkbook.Close
End If

End Sub
12
  • If the code ever throws an error for some reason somewhere down the road, it doesn't look like you have it closing on error. So if they choose to debug they will be able to see your code. Plus excel is not really that secure to begin with.
    – Grant
    Jun 22, 2013 at 0:38
  • I overlooked closing it on error. Thanks for that :-)
    – Kazuo
    Jun 22, 2013 at 0:44
  • 1
    A related question was asked recently. Take a look at Protecting Excel Worksheet Data From Savvy User. Jun 22, 2013 at 4:07
  • 1
    Hi everyone, I'm a self-taught programmer who still has a lot to learn. I think you experts are right. Using Excel VBA to write commercial software is not a good idea and I think Excel passwords can be easily cracked. I have to redo what I did in Excel elsewhere. I could deter the average user but not the experts. I learned something new and I thank you all for taking the time to contribute to my knowledge base. Cheers to everyone and have a nice day :-)
    – Kazuo
    Jun 22, 2013 at 8:02
  • 1
    I hope that's not your actual email and phone number in the code snippet you posted... if you care about security, leaving a combination of two pieces of identification in a public place is a good step in the wrong direction. It's amazing how people can harvest information from disparate sources to create a picture of your identity. I have taken the liberty to obfuscate for you.
    – Floris
    Jun 22, 2013 at 15:57

2 Answers 2

7

Just to demonstrate how badly broken Excel's protection is, do the following experiment:

Create a simple workbook, add a module, and enter the following sub

Sub protectMe()
MsgBox "This should not be seen"
End Sub

Now protect the module with a password, save as secret.xlsm, and exit.

From your "Explorer" or "Finder" (depending on OS), rename the file (change the extension from secret.xlsm to secret.zip). You will find you can now open the file and see its contents - yes, the modern file format for all Office documents is in fact a zip file!

You will find a folder structure inside the zip archive. Go to the xl folder, and you will see vbaProject.bin. When you open this file with a text editor, you will see that it is full of junk - but it also contains the plain text of your code! Here is a brief sample:

�ˇˇ ���ê���@˛ˇˇˇˇˇ|ˇˇˇ�ˇˇ ���Ì���ˇˇˇˇ(���������������������ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇ����ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇH�������������ˇˇˇˇ����ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇ�@���¯<sS�$�*�\�R�f�f�f�f�*�0�9�5�3�7�3�3�d�0�8��*�\�R�0�*�#�1�4�fl������������������������������������������������������������˛ ��"Å��������Å�"�:����Å������ˇˇˇˇ@���ñ������o�ˇˇp���∂��This should not be seen�A@�������ˇˇˇˇ@���ˇˇˇˇ0���ˇˇˇˇx������`���ˇˇˇˇ�������������������ˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇˇ��`∞�Attribut�e VB_Nam�e = "Mod�ule1"
Su�b protec�tMe()
Ms�gBox "Th�is shoul�d not be� seen"
End �h
�������������������rUÄ���Ä���Ä���Ä�����~|���������  ������� �����������������������°������Ñ���D���ƒ�ƒ:�hġh†ˇh¿ˇ∏����∆ˇ�¯‡ˇÏ‡ˇ"���Ú|ˇ≤�‡ˇ¿ˇ†ˇÄˇƒ��’�����Ñ�D�$������'�������������������������‡ˇ�¿ˇ�†ˇ�ġ�����π����������B�����R���������������������������������������������������������������������rUÄ�������Ä���Ä����������  ������ˇˇˇˇˇˇˇˇ��������$�Å���������`��˝ˇˇˇˇˇˇˇˇˇˇˇ���������������n�������������������������������Ãam���ˇ ��  ��'������������™*�\�H�{�0�0�0�2�0�4�E�F�-�0�0�0�0�-�0�0�0�0�-�C�0�0�0�-�0�0�0�0�0�0�0�0�0�0�4�6�}�#�6�.�0�#�9�#�M�a�c�i�n�t�o�s�h� �H�D�:�A�p�p�l�i�c�a�t�i�o�n�s�:�M�i�c�r�o�s�o�f�t� �O�f�f�i�c�e� �2�0�1�1�:�O�f�f�i�c�e�:�V�i�s�u�a�l� �B�a�s�i�c� �f�o�r� �A�p�p�l�i�c�a�t�i�o�n�s�.�f�r�a�m�e�w�o�r�k�:�V�e�r�s�i�o�n�s�:�1�4�:�R�e�s�o�u�r�c�e�s�:�V�B�A� �O�b�j�e�c�t� �L�i�b�r�a�r�y�#

So yes - if you actually care about the security of your software, this is not the way to go...

edit interestingly, when I initially pasted this, the question marks were not there and the code could be read as plain as day (even in the preview of the answer that appears in the browser as you write). Apparently there were some "hidden" characters that showed up during the processing of the input and before it was rendered as the "final" output. It's still very readable though.

5
  • Excellent explanation and example! Very useful.
    – Grant
    Jun 22, 2013 at 14:45
  • Thanks for that insight Floris and for obfuscating. What about CrunchCode (spreadsheet1.com/s1-crunchcode.html) or Invisible Basic (sourceforge.net/projects/invisiblebasic/?source=dlp)? Are these tools hack-proof or do they provide enough obfuscation to make the hacker decide that it's not worth their time figuring out how to get past my so-called "shield"?
    – Kazuo
    Jun 22, 2013 at 21:48
  • @Kazuo - the tools you linked to "help", but they don't solve the problem completely. Whether someone can be bothered to overwrite things is really the key question - but if they can figure out that you test for motherboard ID, then they can look for a cell with a value like that and change it to match their new MB. To get around that you would at least want to hash the value rather than store it in plain text. "Don't use excel if you want security / protect IP". I think you heard that message already, loud and clear...
    – Floris
    Jun 25, 2013 at 16:47
  • Hi Floris, How do hash the string value of my motherboard serial number? Do you have any link that could help me do it?
    – Kazuo
    Jun 26, 2013 at 11:37
  • @Kazuo - I have no specific method in mind. Just thinking that "scattering the number around the spreadsheet" (maybe having 10 cells with random letters/digits, looking at digit 10 in cell 1, digit 9 in cell 2, etc - would be sufficient for someone looking for "where does he store the serial number" to give up...). You could also consider putting it in a tag rather than a cell. Again it makes it harder - not impossible.
    – Floris
    Jun 26, 2013 at 13:31
0

There is no way to guarantee that you can stop a person with Excel skills from copying your workbook. For example, even if I can't see a value in a cell (because you have locked the viewing area) I can still access it via a formula from a different workbook. Password protection? There are many many websites that will crack passwords in Office documents.

A method that might work, however, is to use create a validation server. You could have your own web service that authenticates user names and passwords against motherboard serial numbers. But, even then, a skilled user could reverse engineer your workbook and remove the code that would call the web service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.