Microsoft Turns off Dynamic Data Exchange in One of Its Office Application - Word

In October 2017, IB experts pulled in consideration regarding the issue of utilizing the old Microsoft Dynamic Data Exchange (DDE) innovation , which enables one Office application to download information from different applications. For instance, a table in a Word record can be naturally refreshed each time the document is opened, and the information will be "pulled up" from the Excel document. 

Specialists cautioned that DDE, truth be told, enables you to install a custom field in the report, in which you can determine the area of the information that ought to be stacked. The issue is that aggressors can utilize DDE not to open other Office applications, but rather to dispatch the order line and execute pernicious code. This procedure can turn into a magnificent option for assailants malignant macros and Object Linking and Embedding (OLE). 

Before long it turned out to be certain that the specialists were not amiss with the gauges . One of the biggest botnets on the planet, Necurs, with more than 6 million contaminated machines, started to utilize DDE for the conveyance of Locky's cryptographer and the TrickBot keeping money Trojan. Another noxious battle utilizing DDE is disseminated by the Hancitor loader, which is then used to introduce bank Trojans, spiveware, coercion programming and different dangers. Cisco Talos authorities found that DDE-assaults are utilized amid a pernicious battle, the reason for which is the conveyance of the "non-document" trojan DNSMessenger . What's more, investigators at McAfee announced, that DDE has just been received by government hackers from the infamous Fancy Bear gathering (they are APT28, Sednit, Pawn Storm, Strontium and so on). 

Starting in October, Microsoft engineers reacted to all notices of IB pros by saying that DDE is a true blue capacity that does not require any patches and changes. The organization focused on that for the effective operation of DDE-assaults the client should freely debilitate Protected Mode and close a few insights and alerts illuminating about refreshing documents from remote sources. 

In any case, in November, Microsoft designers made little concessions by distributing a security bulletin committed to the issue. In the report, the specialists disclosed in detail how to guard against DDE assaults and avoid them. 

Presently, December's "Tuesday of updates" brought the fix ADV170021 , which at last summed up the last issue under this issue. The hotfix cripples the utilization of DDE for Word by any stretch of the imagination. Given the across the board commonness of the issue, the fix was presented notwithstanding for Word 2003 and 2007, whose help has for some time been stopped. 

Generally, this refresh rolls out little improvements to the registry, deactivating DDE naturally. To empower the usefulness back, you have to locate the relating an incentive in the \ HKEY_CURRENT_USER \ Software \ Microsoft \ Office \ virsion \ Word \ Security AllowDDE (DWORD) registry and set the fitting an incentive for DWORD: 

AllowDDE (DWORD) = 0: Disables DDE. After the refresh is introduced, this esteem is the default. 

AllowDDE (DWORD) = 1: Enables DDE solicitations to officially running projects, yet does not permit the dispatch of new ones. 

AllowDDE (DWORD) = 2: Enables any DDE asks.