Disable OLE object execution and macros in LibreOffice/OpenOffice as well

[Dyras]

Greetings! I just discovered this excellent program and I propose you harden LibreOffice as well. It's popular for us poor poor students after all.

PS: There's a spelling error on the description for this program

It should say "a utility" since utility is pronounced "youtility"

[obsti8383]

Hi Dyras, thanks for your suggestion. Do you have a tutorial on how to do harden LibreOffice on Windows?

[Dyras]

I've tried looking for a tutorial but I've yet to find anything, however under LibreOffice settings under "Security" there is "Macro security" which should probably be hardened by being set to "Very high" instead of "High".

No idea where to find something on OLE though.

[einsteinsfool]

Macro security can be changed in file registrymodifications.xcu. It is located in the user profile. For Windows it could be e.g.:
%appdata%\LibreOffice\4\user\registrymodifications.xcu
If this line doesn't exist in the file, then add it:
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="MacroSecurityLevel" oor:op="fuse"><value>3</value></prop></item>
If it does exist make sure the value is 3. If not - change it to 3.

I couldn't find anything for OLE. I don't think it's possible to disable it. The only way seems to be asking on LibreOffice forum and probably making a feature request.

There are some other interesting security options that can be changed in that file:

<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="Confirmation" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="DisableMacrosExecution" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="ExecutePlugins" oor:op="fuse"><value>false</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="MacroSecurityLevel" oor:op="fuse"><value>3</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="RecommendPasswordProtection" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="RemovePersonalInfoOnSaving" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="SecureURL" oor:op="fuse"><value></value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="WarnCreatePDF" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="WarnPrintDoc" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="WarnSaveOrSendDoc" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="WarnSignDoc" oor:op="fuse"><value>true</value></prop></item>
<item oor:path="/org.openoffice.Office.Common/Security/Scripting"><prop oor:name="Warning" oor:op="fuse"><value>true</value></prop></item>

I don't know what is the best value for SecureUrl.
Also, some might be not the best choice if you care about user convenience (e.g. users might be annoyed when prompted to make a password for each file).

[obsti8383]

Seems all settings can be managed directly with Registry Keys: https://wiki.documentfoundation.org/Deployment_and_Migration#Windows_Registry (Example already shows how to set MacroSecurityLevel and UpdateCheck)

excerpt:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\LibreOffice\org.openoffice.Office.Common\Security\Scripting\MacroSecurityLevel]
  "Value"="2" 
  "Final"=dword:00000001

[obsti8383]

This gives an good overview of security relevant settings in LibreOffice (German only!): https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_147.pdf?__blob=publicationFile&v=6

I've selected and (auto-)translated the following settings that could be relevant for Hardentools:

HyperlinksWithCtrlClick: If this option is enabled, one mouse click is not enough to follow a hyperlink. must be held.
Default value: Enabled
Recommended value: Enabled
Setting: org.openoffice.Office.Common/Security/Scripting/HyperlinksWithCtrlClick

BlockUntrustedRefererLinks: Defines whether linked images from external sources may be retrieved. A corresponding restriction does not apply to documents stored in trusted locations. The option is only for images. This option does not restrict the retrieval of other media files or linked documents. The option does not restrict retrieval of other media files or linked documents.
Default value: Disabled
Recommended value: Enabled
Setting: org.openoffice.Office.Common/Security/Scripting/BlockUntrustedRefererLinks

MacroSecurityLevel: Defines the security level for handling macros. The following values are possible:

• Low (All macros are allowed to be executed.) - 0
• Medium (The user must confirm the execution of a macro). - 1
• High (Signed macros may be executed.) - 2
• Very High (Only macros from trusted locations may be executed). - 3
  Default value: High
  Recommended value: Very high
  Setting: org.openoffice.Office.Common/Security/Scripting/MacroSecurityLevel

SecureURL: Defines a list of trusted file paths. All documents stored at a trusted file path are allowed to run macros without restriction.
Default value:
Recommended value:
Setting: org.openoffice.Office.Common/Security/Scripting/SecureURL

TrustedAuthors: not relevant, if MacroSecurityLevel is set to "very high"

Link (Calc) & Link (Writer): Defines whether values from linked documents should be loaded automatically when the file is opened. This allows for example to include values from a spreadsheet file into another file. Furthermore, it is also possible to load values via a network. In this case data can be transferred from the open document to another system. The following values are possible:

• Always
• Never
• On demand
  Default value: On demand
  Recommended value: Never
  Settings:
• org.openoffice.Office.Calc/Content/Update/Link
• org.openoffice.Office.Writer/Content/Update/Link

UseStorage: The option specifies whether the LibreOffice password store is enabled. In this memory you can store access data for services that are accessed via HTTP, WebDav, FTP, SSH or Windows SharePoint (CMIS). If credentials are stored, files can be retrieved from the respective service without a new password request.
Default value: Disabled
Recommended value: Disabled
Setting: org.openoffice.Office.Common/Passwords/UseStorage

AutoCheckEnabled: Specifies whether to automatically check for available updates. The user will be is informed about available updates with a message. There is no automatic installation.
Default value: Enabled
Recommended value: Enabled
Setting: org.openoffice.Office.Jobs/Jobs/org.openoffice.Office.Jobs:Job['UpdateCheck']/Arguments/AutoCheckEnabled

CheckInterval: Defines the interval at which new updates should be checked for. The option has no function, if AutoCheckEnabled is disabled. The following values are possible:

• Every day
• Every week
• Every month
  Default value: Every week
  Recommended value: Every day
  Setting: org.openoffice.Office.Jobs/Jobs/org.openoffice.Office.Jobs:Job['UpdateCheck']/Arguments/CheckInterval

[obsti8383]

Published a pre-release / beta version here: https://github.com/securitywithoutborders/hardentools/releases/tag/v2.6-beta

@Dyras , @einsteinsfool Would be very nice, if you could do some testing and provide me feedback.