Slashdot Mirror
Microsoft Disables Word DDE Feature To Prevent Further Malware Attacks (bleepingcomputer.com)
An anonymous reader writes: As part of the December 2017 Patch Tuesday, Microsoft has shipped an Office update that disables the DDE feature in Word applications, after several malware campaigns have abused this feature to install malware. DDE stands for Dynamic Data Exchange, and this is an Office feature that allows an Office application to load data from other Office applications. For example, a Word file can update a table by pulling data from an Excel file every time the Word file is opened. DDE is an old feature, which Microsoft has superseded via the newer Object Linking and Embedding (OLE) toolkit, but DDE is still supported by Office applications.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
The December Patch Tuesday disables DDE only in Word, but not Excel or Outlook. The reason is that several cybercrime and spam groups have jumped on this technique, which is much more effective at running malicious code when compared to macros or OLE objects, as it requires minimal interaction with a UI popup that many users do not associate with malware. For Outlook and Excel, Microsoft has published instructions on how users can disable DDE on their own, if they don't want this feature enabled.
But its a bloody nuisance when you work with something, then it suddenly goes away. Security through loss of function.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
What makes this patch especially interesting is they also released it for Word 2007, which otherwise would be end of life and excluded from updates.
OLE is about 25 years old. If you have to update your software because it's not able to do OLE, it's about fucking time!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
newer Object Linking and Embedding (OLE) toolkit
OLE 1.0, released in 1990, was an evolution of the original Dynamic Data Exchange (DDE) concept
Boy, that's reassuring that OLE is so much newer than DDE. Why the heck is something like DDE still existing in their products when it was superseded by something 27 years ago?
Better known as 318230.
DDE was introduced in Windows 2.0 (in 1987), which also introduced such exciting features as overlapping windows. Computers that ran Windows 2.0 mostly didn't exchange files, but if they did it was most commonly on a 5.25" floppy disk or very occasionally via a serial link. The threat model for these machines largely related to someone breaking into your office and stealing them. Attacking this on most Windows 2.0 machines would have usually involved persuading a random person to accept a floppy disk and then run a program that you gave them (at which point, given the lack of memory protection, you already have complete control over their system and so there's no need for you to use a vulnerability in DDE).
Microsoft has kept this archaic technology for compatibility, because people much like you swear at them whenever the break old and insecure APIs and say that they're just doing it to inconvenience their competitors.
I am TheRaven on Soylent News
You realise DDE originated in 1987 and predates VBA by six years? What software did you write in 1987 that considered a world in which most computers were networked and exchanged untrusted documents?
I am TheRaven on Soylent News
I honestly can't think of anyone still using DDE for anything. Compared to OLE it's clumsy and very, very badly supported. You'll have more comfort writing Windows GUI applications in C++ with Visual Studio than using DDE.
Actually, a lot of Office links still use DDE.
Chas - The one, the only.
THANK GOD!!!
"Actually, a lot of Office links still use DDE."
Not anymore apparently.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
I know this will come as a shock to you, but there are users out there who like their applications to keep on working when their OS is "upgraded".
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
OLE and DDE are completely different things.
In OLE e.g. a program enables you to "copy/paste" a part of an Excel Spread Sheet into your Application. That will be an "Excel Object that is Embedded into your document and Links to Excel so that Excel will recalculate that fragment when you change data"
DDE (dynamic data exchange) is a simple thing where you register a named server, that can be looked up, and you simply pipe strings or read strings from it. It is a fancy name for a local registry that is basically a set of named pipes.
Your document above only works when Excel is installed ... otherwise the excel object embedded in it is worthless.
DDE is just a socket/pipe to which you write more or less like to a file. It is superb for scripting an application, assuming it already has an scripting interface, it is like 5 lines of code to make it remotely scriptable via DDE. Like AppleScript or VBA for Applications make it possible to scrip an Application.
The guys who wrote 25 years ago in MS documentations you should prefer OLE over DDE simply had no clue either that both things are so completely different that it rarely makes sense to chose one over the other.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.