Slashdot Mirror
Microsoft Disables Word DDE Feature To Prevent Further Malware Attacks (bleepingcomputer.com)
An anonymous reader writes: As part of the December 2017 Patch Tuesday, Microsoft has shipped an Office update that disables the DDE feature in Word applications, after several malware campaigns have abused this feature to install malware. DDE stands for Dynamic Data Exchange, and this is an Office feature that allows an Office application to load data from other Office applications. For example, a Word file can update a table by pulling data from an Excel file every time the Word file is opened. DDE is an old feature, which Microsoft has superseded via the newer Object Linking and Embedding (OLE) toolkit, but DDE is still supported by Office applications.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
But its a bloody nuisance when you work with something, then it suddenly goes away. Security through loss of function.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
See subject & demand that your government BANS BUMP STOCKS IMMEDIATELY. Banning bump stocks is the ONLY way to prevent future mass shootings like the Las Vegas shooting.
The Vatican doesn't want bump stocks banned & is spending millions of dollars to LOBBY AGAINST banning bump stocks. The VAST FORTUNE of the Vatican was obtained through illicit means including funding wars in Europe. The tradition of using VIOLENCE to grow the wealth of the Vatican is alive and well. Collectively, the Vatican, George Soros, and the NRA, are fighting (figuratively, I hope) to keep them legal. Jesus Christ is ROLLING IN HIS GRAVE.
* Moderators will undoubtedly attempt to censor my post to -1. This censorship is wrong and is probably paid for by the Vatican. It's no better than Hillary Clinton and the DNC paying shills to support George Soros and spread conspiracy theories about Russia. Slashdot must ultimately ELIMINATE MODERATION.
The real purpose of the Russia investigation is to DEFLECT ATTENTION away from the Democratic COLLUSION with the Vatican. Any alleged Russian meddling in our election was dwarfed by the Vatican meddling, delivering tens of millions of dollars to support DEMOCRATS. Notice how Democrats paid lip service to banning bump stocks & then took no action. On the surface, they appear to support gun control, but in reality Democrats align their agenda closely with the Vatican on nearly all issues. The Vatican is by far the biggest manipulator of American elections, but does so behind the scenes. That is why only one Catholic has ever been elected President and he was assassinated by the Vatican for going against their plan to remain IN THE SHADOWS.
Good posts (like this one) keep ending up at -1, and it makes Slashdot IMPOSSIBLE to read. Moderation (censorship) is RUINING this site. The moderation system has become a means for enforcing groupthink and SILENCING users like Creimer who become unpopular with a small group of MORONS with mod points. Once their karma is depleted by the ABUSE, they can only post twice a day, and at a score of -1. I post anonymously so my imposters can't silence me in the same manner. Otherwise, I would no doubt be their next victim based on the amount of abuse I take.
Most of the abuse is because I won't OpenSORES my Hosts File Engine. JEALOUS LOSERS are angry they can't PIRATE my code and because I tell the TRUTH about them in my posts. Most are angry because they keep DESTROYING themselves against me. It's really quite sad and pathetic.
APK
P.S.=> Idiots like AssFux(lol) have no courage. They will keep censoring my posts and making false statements about me. I circumvent their feeble efforts with my Hosts File Engine. It's also FAR more secure than any antivirus or firewall can ever hope to be... apk
This bug still? I was hit with this attack back in 2008, it encrypted my MSWord interface to this weird long list of unusable modal icons, rendering my Office suite unusable.
I had to switch to LibreOffice to fix it.
I'm shocked that this is still happening in 2017 nearly a decade later!
What makes this patch especially interesting is they also released it for Word 2007, which otherwise would be end of life and excluded from updates.
Microsoft has superseded via the newer Object Linking and Embedding (OLE)
By breaking backwards compatibility, everyone else has to have to pony up for a newer version of Word to view your documents.
Imagine that.
This is the fucking problem with Microsoft, every fucking thing has to be able to execute fucking code and talk to fucking everything else that can also execute fucking code.
And then you fucking wonder why Microsoft is not fucking secure?
Fuck.
newer Object Linking and Embedding (OLE) toolkit
OLE 1.0, released in 1990, was an evolution of the original Dynamic Data Exchange (DDE) concept
Boy, that's reassuring that OLE is so much newer than DDE. Why the heck is something like DDE still existing in their products when it was superseded by something 27 years ago?
Better known as 318230.
"disables DDE only in Word, but not Excel or Outlook"
News from next week - cybercriminals switch to using malicious Excel sheets instead of Word documents in their malware spam.
Seriously, what are they thinking here?
in the long tradition of long reaching poor ideas like VBA (which had to be disabled in IE for security issues which finally happened in IE7), IIS with insecure settings on be default (for convenience), now comes DDE. Things that had to be changed or disabled because of things anyone thinking it through would realize, is a bad idea. Of course Windows defender is a bit of a joke in the security world as well. The fact the update was done for Word 2007 probably means this vulnerability was so bad they included it to avoid repercussions from lawsuits of the government worried about foreign exploitation. Windows 10 in general (or at least the spyware components) will probably be on this list before long because people will finally wake up and realize what is happening, or some foreign country will exploit it to collect data and we'll be like, "how could MS do this?" answer: because we sat back, and let them. Security comes at the price of convenience, and MS has historically been poor at finding this balance, making things that are neither convenient or secure (at least in comparison to MacOS and Linux) . I specifically say "foreign power" because governments love backdoors, and "telemetry data" to spy on it's entire population. But..they seem to be of the illusion that you can make a door that only one specific group can use and other cannot find and use themselves.
"Imagination is more important than knowledge" - Einstein
Details here -
http://blog.talosintelligence.com/2017/10/dnsmessenger-sec-campaign.html
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
I has this same feeling when they started pretending like NT4.0 never existed, "Security through loss of function."
DDE did a job on me
Now my desktop's a real sickie
Guess I have to break the news
Now I've got no files to lose
Code Red caused a trichotomy
My PC is a lobotomy!
Lobotomy!
Lobotomy!
- from "Teenage Lobotomy" (Ramones)
DDE was already obsolete by the time Windows 98 came out, and should have been removed then.
Now I can stop fighting the desktop team re: killing DDE in Word via GPO as they will blindly deploy M$'s "patch." Win!