Newsletter Archives

  • Office as a malware delivery platform: DDE, Scriptlets, Macro obfuscation

    I thought we got over the Office macro malware blues back in the 90s. Nope. All of that high-powered native document intelligence is coming back to bite us.

    Computerworld Woody on Windows.

  • Microsoft releases a Security Advisory about the DDEAUTO fandango

    I first wrote about the Word {DDEAUTO} field and its weird ways in “Hacker’s Guide to Word for Windows.” Yes, that was 23 years ago. {DDEAUTO} precedes Word macros, I do believe.

    Recently, some very smart folks have re-discovered the field and put it to nefarious purpose.

    @arekfurt has a great timeline.

    The speed of adoption of the DDE technique (roughly):

    -10/09: @sensepost blog post (re)discovering & validating technique
    -10/10: @GossiTheDog tweets about, fleshes out info on extensively
    -10/11: spotted in-the-wild (FIN7)
    -10/13: start of big surge in usage
    -10/25: Fancy Bear

    Those are all in 2017. The {DDEAUTO} field hasn’t changed a bit in two decades.

    Microsoft just released Security Advisory 4053440:

    Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields

    Microsoft is releasing this security advisory to provide information regarding security settings for Microsoft Office applications. This advisory provides guidance on what users can do to ensure that these applications are properly secured when processing Dynamic Data Exchange

    Deja vu, eh? Consider this post from Oct. 27:

    The big threat now is from that Wacky Wascal BadRabbit, which started with a fake Flash update on a Russian site and an ancient DDEAUTO field exploit in Word (and Excel and Outlook and OneNote) and is being used to carry Locky and other ransomware.

    The DDEAUTO exploit isn’t a bug, according to Microsoft, because you have to click through three warning dialogs before it’ll bite. (The first of which is “Enable Editing.” Sound familiar?)

    Disable DDEAUTO by following these steps from Martin Brinkmann at ghacks. Note that this is a rather draconian approach, with consequences for OneNote, Outlook and others described by Will Dormann. If you find that something breaks after you’ve clobbered DDEAUTO – most likely, an older document that no longer updates properly – you won’t have much choice but to turn DDEAUTO back on. While you’re at it, tattoo inside your eyelids: “Do NOT Enable Editing.”

    Anyway, if you (or your users) are prone to clicking on “Enable Editing,” it’d be worthwhile following the Security Advisory instructions or Martin Brinkmann’s steps to turn off DDEAUTO.