Microsoft 365 Will Turn Off ActiveX, Because Hackers Keep Using It

Microsoft 365 is finally phasing out ActiveX, a long-standing security vulnerability in its Office suite. This follows a similar move in Office 2024. Beginning this month, Windows versions of Word, Excel, PowerPoint, and Visio in Microsoft 365 will disable ActiveX content by default. Mac and web versions were never compatible with ActiveX.

Microsoft's blog post explains the security benefits of this change. The previous "Prompt me before enabling" default setting allowed potentially dangerous ActiveX controls to be enabled, creating vulnerabilities. The new default provides enhanced security by completely blocking these controls, minimizing malware and unauthorized code execution risks.

Related: ActiveX: A Retrospective on the Web's Security Flaw

ActiveX, introduced in 1996, presented significant security challenges and contributed to Internet Explorer's dominance, hindering web innovation.

This security update, already implemented in Office 2024, is now rolling out to Microsoft 365. It's currently available in the Beta Channel (Version 2504, Build 18730.20030 or later) and will soon be available to all Windows users.

While ActiveX isn't entirely removed, organizations can still enable it, and individual users can re-enable it via File > Options > Trust Center > Trust Center Settings > ActiveX Settings. The option to "Prompt me before enabling all controls with minimal restrictions" can be reactivated.

The End of ActiveX?

ActiveX, initially designed to embed complex code and interactive content in Internet Explorer and Office documents, became notorious for its exploitation in phishing and malware attacks. Numerous security breaches leveraged ActiveX to compromise Windows systems. Its inherent security risks led to its exclusion from Microsoft Edge.

Related: Enhance Your Word Productivity with These 8 Add-ins

Microsoft Word add-ins offer powerful productivity enhancements.

Although Office apps were updated to prevent automatic ActiveX execution, malicious files could still trick users into enabling content. Microsoft's default disabling of ActiveX significantly reduces this risk.

While this change suggests a potential complete removal of ActiveX in the future, Microsoft hasn't confirmed this. Some documents rely on ActiveX, and the Add-ins platform isn't a full replacement. This default disabling represents the most secure configuration currently possible for ActiveX within Office.

This move follows Microsoft's 2022 decision to automatically block VBA macros, another common vector for malware distribution, across all supported Office versions (LTSC, 2021, 2019, 2016, and 2013).

The above is the detailed content of Microsoft 365 Will Turn Off ActiveX, Because Hackers Keep Using It. For more information, please follow other related articles on the PHP Chinese website!