Saturday, November 2, 2024
HomeComputer SecurityImportant Security practices for users to Open Microsoft Office Documents Securely

Important Security practices for users to Open Microsoft Office Documents Securely

Published on

Malware protection

Microsoft office documents utilized in wide by attackers to send the malicious file and then convincing the user to open the file with social engineering methods.

With Microsoft, there are several methods to exchange data between applications and the most popular one is DDE know as Dynamic Data Exchange which sends messages between applications and uses shared memory to exchange data between applications. It can be used for onetime or for continuous exchange.

Here you can see the video Tutorial for DDE Exploit done by our Team.

- Advertisement - SIEM as a Service

Hackers using this method in wild to execute malicious scripts and to compromise victims. Microsoft released best security practices on how to safely open Office documents that contain Dynamic Data Exchange and strongly recommends to review the security feature.

In an email attack scenario, an attacker could leverage the DDE protocol by sending a specially crafted file to the user and then convincing the user to open the file, typically by way of an enticement in an email. Microsoft said.
The attacker would have to convince the user to disable Protected Mode and click through one or more additional prompts. As email attachments are a primary method an attacker could use to spread malware, Microsoft strongly recommends that customers exercise caution when opening suspicious file attachments.

Recent MS office Remote Code Execution Vulnerability allows an attacker to take complete control of infected Windows Operating System and this vulnerability has been affected with all version of Microsoft Office. It was addressed by Microsoft with security advisory CVE-2017-11826.

Also Read Exploiting Windows Using Microsoft Office DDE Exploit (MACROLESS)

Mitigations for DDE attack – Microsoft

Microsoft Excel

Excel heavily depends on DDE to open documents, Microsoft suggests disabling Disable automatic update of Workbook Links to prevent auto updates from Excel including DDE, OLE.

If you disable Auto update then data will not be up to date, so the user needs to feed data manually. Applies to Office 2007, 2010, 2013, 2014.

To disable the DDE feature via the user interface:

Set File->Options->Trust Center->Trust Center Settings…->External Content->Security settings for Workbook Links = Disable automatic update of Workbook Links.

To disable the DDE feature via the Registry Editor:

[HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Excel\Security]
WorkbookLinkWarnings(DWORD) = 2

Microsoft Word – Office documents

For Office 2010 and above

[HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Word\Options]
DontUpdateLinks(DWORD)=1

For Office 2007

[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\vpref]
fNoCalclinksOnopen_90_1(DWORD)=1

Microsoft Outlook

For Office 2010 and above

[HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Word\Options\WordMail]
DontUpdateLinks(DWORD)=1

For Office 2007

[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Options\vpref]
fNoCalclinksOnopen_90_1(DWORD)=1

With windows 10 after fall creator update Windows Defender Exploit Guard able to block DDE-based malware within Attack Surface Reduction according to Microsoft.
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Digital Wallets Bypassed To Allow Purchase With Stolen Cards

Digital wallets enable users to securely store their financial information on smart devices and...

Best SIEM Tools List For SOC Team – 2024

The Best SIEM tools for you will depend on your specific requirements, budget, and...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...