Simple trick to look (hack) into hidden sheet

This post is inspired by the previous post Excel Humor #9 – You do not see me

Situation

Suppose you are going to share an Excel workbook to your colleagues.  However there is a worksheet with sensitive data that you don’t want them to see.  So you hide the worksheet.  As you know Excel well, you further Protect Workbook, with password set, in order to avoid user from unhiding the worksheet.

Excel Tips - Look into hidden sheet

Since you are also a careful person, you test to make sure no one can unhide the worksheet unless one knows the password to unprotect workbook:Excel Tips - Look into hidden sheet 1.gif

Now you are pretty sure that no one can unhide the worksheet, without the password.

YES! BUT… ARE YOU SURE NO ONE CAN SEE THE DATA ON IT?

Here’s a simple trick to look into the data on the hidden sheet.  Indeed I don’t even need to unhide the worksheet to get the data on it.

Did you notice that the name of the hidden worksheet was disclosed in the VB Editor? That’s the window you saw after clicking “View Code” in the above screencast.

From there, I know that the Hidden Sheet is called “Secret“.Excel Tips - Look into hidden sheet2

With this little piece of information, anyone can retrieve the data on any cell on the worksheet easily.

A picture tells thousand words; a sceencast tells even more 🙂Excel Tips - Look into hidden sheet 2

See?!  What I did was just a simple formula of referencing:

=Secret!A1

Secret No More!!!

Conclusion

Please don’t get me wrong.  I am not encouraging you to hack into data that is not intended for you.  My point here is:

DO NOT include sensitive/confidential/private data in a workbook at all, if the recipients are not supposed to read that.

Advertisements
This entry was posted in General and tagged . Bookmark the permalink.

11 Responses to Simple trick to look (hack) into hidden sheet

  1. Doug Glancy says:

    Hi, I recently did something like this when I inherited a protected workbook full of hidden sheets. I was even able to resurrect a bunch of charts, by cycling through them with VBA.

    Like

  2. Saba says:

    Awesome trick,please do keep sharing your brilliant ideas they are always…… impressive!!

    Like

  3. Michael (Micky) Avidan says:

    Hi,
    If you define the Sheet’s “VISIBLE” Property to: xlSheetVeryHidden, and you Password protect your VBAProject – you make it much more difficult to break into the VB Editor in order to see the Hidden sheets name.

    *** There are a few ways to crack into a Protected VBA Projects (I’m not going to share them here).

    Michael (Micky) Avidan

    Like

    • MF says:

      Hi Micky,
      Yes but… there are many ways to list all worksheets’ name with simple codes in Immediate Window. 🙂

      Like

      • Michael (Micky) Avidan says:

        Hi, Wong,
        I am realy confused – and will be glad to learn how to show/activate the “Immediate window” under/within a Password Protected VBAProject ?
        Michael (Micky) Avidan

        Like

        • MF says:

          Hi Micky,
          Thanks for your question.

          I am not good in VBA… I thought I can still use Immediate Window in VBE… I tried to password protect the VBA project using Excel 2011 for Mac… and it worked…

          So what i am thinking is… 1) i didn’t protect the VBA project properly, 2) it works differently in Mac. Probably 1) 😅

          Let me try on a windows machine later.

          Other thought: can we use a new workbook and its Immediate Window to get the worksheet name of another workbook? 🤔

          Have a nice weekend! Cheers

          Like

          • MF says:

            Hi Micky,

            I just tried in Excel 2013. It works too. In the VBE, go to View –> Immediate Window. or simply Ctrl+G (if the Immediate Window is not visible). I can see and work with the Immediate Window as usual. Moreover, I can open an new workbook and use VBA to get all worksheets’ name (hidden, very hidden, or visible) of another workbook successfully. Having said that, as concluded in my blogpost, it’s not about how to get the data on a hidden sheet. It’s about NOT to consider “hiding” something in a workbook as a secure way to protect data from being seen.

            Side topic: I found sth strange in my trial with the VBE… When I tried to lock the VBProject by right-clicking it, Properties, Protection, Lock from Viewing, passwords… OK. Saved the file. Reopened it. Then the password is GONE…. NO protection at all. Then I tried again and saved it as xlsm. Still didn’t work. Then I inserted a blank module to the VBProject, then it worked…… Strange?
            As I said, I am not good in VBA, maybe I missed something that I don’t know. ~_~

            Like

          • Michael (Micky) Avidan says:

            Hi, Wong,
            1) In order to password protect and maitain a VBAProject you must have at least one Macro in it.
            Try:
            Sub Hi()
            MsgBox “Hi…”
            End sub
            2) I still don’t get to the bottom of how to present/open the Immediate window in a Protected(!) VBAProject.
            Could you explain in details ? (Step-by-step, please)
            Have an nice weekend,
            Micky

            Like

          • MF says:

            Hi Micky,
            Are we talking about the same “Window”? What I meant was the “Immediate Window”, that can be activated in the VBE.
            View –> Immediate Window
            (Shortcut: Ctrl+G)
            To my understand, “Immediate Window” does not belong to any specific VBAProject, so that can be opened regardless of password protection status.

            Like

Comments, suggestions, corrections are welcome.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s