{"id":3452,"date":"2017-10-20T09:21:08","date_gmt":"2017-10-20T07:21:08","guid":{"rendered":"http:\/\/securite.intrinsec.com\/?p=3452"},"modified":"2017-10-20T09:21:08","modified_gmt":"2017-10-20T07:21:08","slug":"malware-infections-dde-office","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/malware-infections-dde-office\/","title":{"rendered":"Malware: infections via Microsoft Office Dynamic Data Exchange (DDE)"},"content":{"rendered":"

Context<\/h1>\n

Cybercriminals are constantly searching for new ways to deploy malicious code on their victims' systems. Sophisticated groups are exploiting vulnerabilities 0-day<\/em> While Flash Player is used for targeted attacks, it is not uncommon to see some actors adopt less sophisticated but easily applicable methods in the context of mass dissemination campaigns. malware<\/em>.<\/p>\n

This is the case for DDE (for Dynamic Data Exchange<\/em>), a Windows feature used in Word and other Office products to embed dynamic external content within a document. For the past few weeks, articles have been popping up online describing how to execute arbitrary commands on a system by exploiting DDE. Today, we've seen that this opportunity hasn't escaped the notice of cybercriminals.<\/p>\n

Let's look back at a specific case we were able to observe and the possible countermeasures.<\/p>\n

In practice<\/h1>\n

We obtained a sample of emails from a distribution campaign of the Locky ransomware<\/em>\u00a0following a classic format: an attachment in .doc format, accompanied by a succinct message suggesting that it is an invoice.
\"\"<\/p>\n

By default, when opening a document containing DDE fields, Word (for example) will attempt to automatically update the content associated with these resources. Opening the document therefore displays a dialog box:
\"\"<\/p>\n

Choosing "Yes" displays a new dialog box, which contains elements of the code that will be executed and may indicate to the informed user that something suspicious is going on:
\"\"<\/p>\n

Selecting "Yes" at this point triggers the code's execution. A "No" to either option is enough to disarm the trap.<\/p>\n

Displaying the document fields allows you to view the code associated with the DDE functionality. In our case, it's a simple PowerShell command line that downloads a script before executing it:
\"\"<\/p>\n

After several intermediate charges, the malware<\/em>\u00a0The final version is deployed. This was a variant of\u00a0Locky<\/em> :
\"\"<\/p>\n

Prevention<\/h1>\n

This analysis shows that the DDE infection vector is, in practice, very simple to implement. Fortunately for potential victims, it is necessary to confirm two dialog boxes before the payload is executed, and some of the text in these windows can alert the user to the malicious nature of the situation. These aspects may limit the effectiveness of the technique, but the analysis also shows that cybercriminals are not deterred by such considerations and are willing to try anything to surprise their targets.<\/p>\n

It is still possible to completely eliminate the appearance of dialog boxes by disabling the DDE link update functionality when opening a document.<\/p>\n

Individuals can protect themselves by unchecking the box Update the links on opening<\/strong> Advanced options for Office programs:
\"\"<\/p>\n

This setting can be controlled via Group Policy (GPO) for larger-scale deployments. First, the Office administrative templates must be installed. Then, a Group Policy Object must be created, and the following steps must be followed. User configuration > Administrative templates<\/strong>. From there, select the products to configure and set the link update option on\u00a0Disable<\/strong>.
\"\"<\/p>\n

Outlook Case<\/h3>\n

This was not the case in the observed campaign, but a DDE field can also be included directly in the body of an email, without using an attachment. A new limiting factor then appears for the operation: the link updates only occur when the email is opened in editable mode, i.e., to reply to or forward it.<\/p>\n

There is no built-in option in Outlook or in the administrative templates to block this behavior; it requires a registry modification. This change can still be deployed via Group Policy, through the registry tree. User Configuration > Preferences > Windows Settings > Registry<\/strong> from the GPO object editor. Next, a new Registry item must be created with the following parameters:<\/p>\n