Slashdot Mirror
Microsoft Disables Word DDE Feature To Prevent Further Malware Attacks (bleepingcomputer.com)
An anonymous reader writes: As part of the December 2017 Patch Tuesday, Microsoft has shipped an Office update that disables the DDE feature in Word applications, after several malware campaigns have abused this feature to install malware. DDE stands for Dynamic Data Exchange, and this is an Office feature that allows an Office application to load data from other Office applications. For example, a Word file can update a table by pulling data from an Excel file every time the Word file is opened. DDE is an old feature, which Microsoft has superseded via the newer Object Linking and Embedding (OLE) toolkit, but DDE is still supported by Office applications.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
But its a bloody nuisance when you work with something, then it suddenly goes away. Security through loss of function.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
This bug still? I was hit with this attack back in 2008, it encrypted my MSWord interface to this weird long list of unusable modal icons, rendering my Office suite unusable.
I had to switch to LibreOffice to fix it.
I'm shocked that this is still happening in 2017 nearly a decade later!
What makes this patch especially interesting is they also released it for Word 2007, which otherwise would be end of life and excluded from updates.
OLE is about 25 years old. If you have to update your software because it's not able to do OLE, it's about fucking time!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
That does not mean someone did not create new software using a document supported feature of the product just last week.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Then that someone is incompetent and deserves all that is coming.
By your logic, nothing could ever get phased out, no matter how bad it is.
newer Object Linking and Embedding (OLE) toolkit
OLE 1.0, released in 1990, was an evolution of the original Dynamic Data Exchange (DDE) concept
Boy, that's reassuring that OLE is so much newer than DDE. Why the heck is something like DDE still existing in their products when it was superseded by something 27 years ago?
Better known as 318230.
Microsoft has superseded via the newer Object Linking and Embedding (OLE)
By breaking backwards compatibility, everyone else has to have to pony up for a newer version of Word to view your documents.
Imagine that.
Microsoft Office is well known for being incompatible with itself.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
"disables DDE only in Word, but not Excel or Outlook"
News from next week - cybercriminals switch to using malicious Excel sheets instead of Word documents in their malware spam.
Seriously, what are they thinking here?
I honestly can't think of anyone still using DDE for anything. Compared to OLE it's clumsy and very, very badly supported. You'll have more comfort writing Windows GUI applications in C++ with Visual Studio than using DDE.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
There's no need to for that kind of language.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
in the long tradition of long reaching poor ideas like VBA (which had to be disabled in IE for security issues which finally happened in IE7), IIS with insecure settings on be default (for convenience), now comes DDE. Things that had to be changed or disabled because of things anyone thinking it through would realize, is a bad idea. Of course Windows defender is a bit of a joke in the security world as well. The fact the update was done for Word 2007 probably means this vulnerability was so bad they included it to avoid repercussions from lawsuits of the government worried about foreign exploitation. Windows 10 in general (or at least the spyware components) will probably be on this list before long because people will finally wake up and realize what is happening, or some foreign country will exploit it to collect data and we'll be like, "how could MS do this?" answer: because we sat back, and let them. Security comes at the price of convenience, and MS has historically been poor at finding this balance, making things that are neither convenient or secure (at least in comparison to MacOS and Linux) . I specifically say "foreign power" because governments love backdoors, and "telemetry data" to spy on it's entire population. But..they seem to be of the illusion that you can make a door that only one specific group can use and other cannot find and use themselves.
"Imagination is more important than knowledge" - Einstein
Details here -
http://blog.talosintelligence.com/2017/10/dnsmessenger-sec-campaign.html
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
DDE was deprecated with win32. It was an old Win16 interface that was superseded by OLE (which has gone through a few iterations itself). The only reason to use DDE is for compatibility with legacy 16-bit applications, most of which won't even run on 64-bit Windows.
I am TheRaven on Soylent News
DDE was introduced in Windows 2.0 (in 1987), which also introduced such exciting features as overlapping windows. Computers that ran Windows 2.0 mostly didn't exchange files, but if they did it was most commonly on a 5.25" floppy disk or very occasionally via a serial link. The threat model for these machines largely related to someone breaking into your office and stealing them. Attacking this on most Windows 2.0 machines would have usually involved persuading a random person to accept a floppy disk and then run a program that you gave them (at which point, given the lack of memory protection, you already have complete control over their system and so there's no need for you to use a vulnerability in DDE).
Microsoft has kept this archaic technology for compatibility, because people much like you swear at them whenever the break old and insecure APIs and say that they're just doing it to inconvenience their competitors.
I am TheRaven on Soylent News
I has this same feeling when they started pretending like NT4.0 never existed, "Security through loss of function."
DDE did a job on me
Now my desktop's a real sickie
Guess I have to break the news
Now I've got no files to lose
Code Red caused a trichotomy
My PC is a lobotomy!
Lobotomy!
Lobotomy!
- from "Teenage Lobotomy" (Ramones)
DDE was already obsolete by the time Windows 98 came out, and should have been removed then.
I honestly can't think of anyone still using DDE for anything. Compared to OLE it's clumsy and very, very badly supported. You'll have more comfort writing Windows GUI applications in C++ with Visual Studio than using DDE.
Actually, a lot of Office links still use DDE.
Chas - The one, the only.
THANK GOD!!!
-- posting to undo accidental moderation --
"Actually, a lot of Office links still use DDE."
Not anymore apparently.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
DDE was deprecated with win32.
Source please. Perhaps you are thinking of NetDDE?
Plain DDE may have been deprecated for use with the office programs, but it worked just fine for other things. I have made win32 programs that used DDE for (local) communication. Compared to the alternatives (tcp-over-loopback, shared memory+shared-mutexes, named-pipes) it works fine.
The Microsoft Visual C++ 5 documentation told me to not use DDE in new projects and to prefer OLE. I don't have a more recent reference, because I haven't run Windows for about 20 years.
I am TheRaven on Soylent News
Proof? You don't have a shred of evidence that banning bump stocks will change mass shootings one way or another. I might as well start posting that we should demand bump stocks on all weapons including melee weapons to prevent mass shootings.
I was fully intent on writing lots of C++ code for GUI Windows programs, you insensitive clod!
Fair enough. I seem to recall that microsoft was trying to get people to use OLE for embedded objects. For such uses OLE is definitely more appropriate than DDE.
Remember, they only disabled it for Word.
It still works in Excel and Outlook.
It'll probably be stripped completely out of Office 2018 though.
Chas - The one, the only.
THANK GOD!!!
OLE is not DDE ... and I doubt people use any of those two things often, if at all.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
And how do you pump data into "You'll have more comfort writing Windows GUI applications in C++" if not via DDE?
I guess you don't really know what DDE is and how it works.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
OLE and DDE are completely different things.
In OLE e.g. a program enables you to "copy/paste" a part of an Excel Spread Sheet into your Application. That will be an "Excel Object that is Embedded into your document and Links to Excel so that Excel will recalculate that fragment when you change data"
DDE (dynamic data exchange) is a simple thing where you register a named server, that can be looked up, and you simply pipe strings or read strings from it. It is a fancy name for a local registry that is basically a set of named pipes.
Your document above only works when Excel is installed ... otherwise the excel object embedded in it is worthless.
DDE is just a socket/pipe to which you write more or less like to a file. It is superb for scripting an application, assuming it already has an scripting interface, it is like 5 lines of code to make it remotely scriptable via DDE. Like AppleScript or VBA for Applications make it possible to scrip an Application.
The guys who wrote 25 years ago in MS documentations you should prefer OLE over DDE simply had no clue either that both things are so completely different that it rarely makes sense to chose one over the other.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
So am I. I refuse to touch the atrocity that is C# for as long as I possibly can.
But it gets harder and harder with every incarnation of Visual Studio.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Please don't tell me you use anything coming from MS Office as a trusted data source.
That's for managers so they can play with something and don't get in the way of working people.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why? the article is incorrect in saying OLE superseded DDE, DDE also has some other advantages which OLE doesn't do, they are actually 2 completely different things. And also, I always learned, if it ain't broke, don't fix it. Do be honest, the current Office365 is really REALLY crap compared to the older versions (webbased isn't even funny how crap that one is).
The problem is, it is broke.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Actually it isn't broken, it does what it needs to do... but others can misuse that functionality..
A documented supported feature Microsoft has been telling you for decades to stop using. Anyone using it has proven that their not qualified to work in software development.