Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 753224" data-attributes="member: 32260">I found some issues with recommended by Microsoft the MS Office hardening tweaks. Those tweaks are adopted in Hard_Configurator (&lt;Documents Anti-Exploit&gt;) and SysHardener. They should block VBA Macros, DDE, OLE, and ActiveX in MS Office documents (MS Office 2007 up to MS Office 2016).The DDE mitigations sources:<ol>
<li data-xf-list-type="ol"><a href="https://technet.microsoft.com/en-us/library/security/4053440.aspx" target="_blank">Microsoft Security Advisory 4053440</a></li>
<li data-xf-list-type="ol"><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170021" target="_blank">{{windowTitle}}</a> - ADV170021 | Microsoft Office Defense in Depth Update</li>
</ol>The issue I found is related to DDE in Excel (mitigations worked in Word). The tweaks from the first link did not work for my Office 2010 (in VirtualBox) until I manually installed the concrete update (excel2010-kb4011660-fullfile-x86-glb.exe) adviced in the second link. It seems that the required updates are not always offered via Windows Updates.How to check if DDE is blocked in Excel? It is very simple.<ol>
<li data-xf-list-type="ol">Create the blank workbook.</li>
<li data-xf-list-type="ol">In the first cell (A1) insert (copy/paste) the formula: =cmd|&#039;/c calc.exe&#039;!A1</li>
<li data-xf-list-type="ol">If this formula will open from Excel the calculator application then DDE is not blocked.</li>
<li data-xf-list-type="ol">Also, you can save this workbook, close Excel and open the workbook from Explorer to test DDE.</li>
</ol><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />EditWhen using custom Hard_Configurator settings, please check first if cmd.exe is unblocked (&lt;Block Sponsors&gt;).</blockquote>

[QUOTE="Andy Ful, post: 753224, member: 32260"] I found some issues with recommended by Microsoft the MS Office hardening tweaks. Those tweaks are adopted in Hard_Configurator (<Documents Anti-Exploit>) and SysHardener. They should block VBA Macros, DDE, OLE, and ActiveX in MS Office documents (MS Office 2007 up to MS Office 2016). The DDE mitigations sources: [LIST=1] [*][URL='https://technet.microsoft.com/en-us/library/security/4053440.aspx']Microsoft Security Advisory 4053440[/URL] [*][URL='https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170021']{{windowTitle}}[/URL] - ADV170021 | Microsoft Office Defense in Depth Update [/LIST] The issue I found is related to DDE in Excel (mitigations worked in Word). The tweaks from the first link did not work for my Office 2010 (in VirtualBox) until I manually installed the concrete update (excel2010-kb4011660-fullfile-x86-glb.exe) adviced in the second link. [COLOR=rgb(0, 0, 0)]It seems that the required updates are not always offered via Windows Updates.[/COLOR] How to check if DDE is blocked in Excel? It is very simple. [LIST=1] [*]Create the blank workbook. [*]In the first cell (A1) insert (copy/paste) the formula: [COLOR=rgb(184, 49, 47)][B]=cmd|'/c calc.exe'!A1[/B][/COLOR] [*]If this formula will open from Excel the calculator application then DDE is not blocked. [*]Also, you can save this workbook, close Excel and open the workbook from Explorer to test DDE. [/LIST] (y) Edit When using custom Hard_Configurator settings, please check first if cmd.exe is unblocked (<Block Sponsors>). [/QUOTE]

Verification