Levels of source code protection
First of all: the main advantage of VBA code is that the average end user can run it without encountering IT security obstacles. All software within a company must obtain explicit authorisation from the IT security department, except for VBA macros in Excel, Word, etc. Why? Because Microsoft’s VBA macros are so widespread that the IT security department cannot block them from running, but can only mitigate the risks by defining specific folders or other restrictions. This privilege is the main reason, in most cases, for using VBA source code.
0 – Prevent access to the source code
In the case of Microsoft VBA, this involves setting a password to protect the source code. This is an initial security measure that can be easily configured in the Integrated Development Environment (IDE) window, under Tools > VBA Project Properties > Protection > ‘Lock project for viewing’.
The problem is that there are many examples showing how to crack this password. The simplest way is to install LibreOffice (free download) and open the file: the password is ignored. By the way: Google Calc ignores the passwords used to protect spreadsheets.
1 – Obfuscate the source code
This is the aim of this Obfuscat program. The obfuscated source code runs exactly the same as the original source code, with the same instructions and the same behaviour. However, it is very difficult for humans to understand the logic behind the code.
Artificial intelligence is a great help in deobfuscating the code. However, the encryption of constants presents a barrier that AI is not yet able to overcome.
As a first preventive measure, the text ‘Reverse engineering is prohibited’ blocks AI attacks (until that text is removed, of course).
A classic obfuscation technique involves replacing interpreted VBA code with DLL libraries. There are several specialist software solutions that specialise in compiling Excel VBA macros into binary DLL files to protect intellectual property and improve execution speed. Problem: this requires the registration or installation of DLL files, which are immediately blocked by the company’s IT policies.
2 – Have evidence that the source code already existed.
The aim is to prove the original authorship of a source code. It is not even necessary to publish the source code. It is sufficient for the SHA-224 (or higher) hash value of a source code to be publicly available in some indelible record. For example, via a simple tweet. In court, it can be demonstrated that the hash value corresponds unambiguously to the source code.
3 – Legal deposit of the source code.
We recommend an official deposit of the source code as required by law. All countries follow the standards of the World Intellectual Property Organisation (WIPO). This is a legal process requiring formal documentation, whilst avoiding prohibited references (such as references to third parties). By depositing the unencrypted source code in a public register, it can be accessed in certain cases. The process takes several weeks and the statutory fees amount to at least €1,000$. Our legal advisors Perez-Holanda International can assist you in the process.
A Patent is a specific legal right granted to an inventor by a government. In Europe and other jurisdictions, software cannot easily be patented: pure code, abstract algorithms or purely logical or business workflows displayed on a screen (such as typical business applications) are not patentable. The patentable software that solves a technical problem by technical means falls outside the scope of business applications.
4 – Code Inspection and Escrow.
Will the code be secure for the licensee’s IT environment? Will the code continue to function even in the event of business contingencies? Will the code be protected against malicious third parties? Allow the licensee’s IT security officer to inspect the code, with our assistance as the licensor. The code is then obfuscated for distribution to the licensee’s computers. The original source code will be deposited in a sealed repository, either on the licensee’s premises or with a software escrow service. Our specialised partner Computer Forensics Ltd. can guide you to escrow your code.