What is the security purpose behind the "enable editing" of MS Word?

Question

Whenever I open MS Word documents from my email, they open in "Protected View" with edit options disabled by default.

As per my understanding, the hyperlinks used in the main document would be linked with spyware/malware so enabling the edit option will lead to the spread of malware. I have also heard about Macro virus which are capable of spreading when the file is opened.

Are there any other reasons behind the protected view of Word files?

Answer 1

Well macro's would allow you to automatically start running scripts on the machine once the document was opened. Hence they get opened in a protected mode to prevent code execution from happening automatically (the user needs to aprove it explicitly).

Also from the MS website:

Files from the Internet and from other potentially unsafe locations can contain viruses, worms, or other kinds of malware that can harm your computer. To help protect your computer, files from these potentially unsafe locations are opened in Protected View. By using Protected View, you can read a file and see its contents while reducing the risks.

Answer 2

Summary: MS Office will try to protect you from macro code even if you don't use "Protected View". "Protected View" is an extra layer of security for files opened from "untrusted" locations (such as e-mail attachments).

---

Details:

A long time ago, MS Office would automatically run macros contained in Office files. Macro viruses exploited that fact and used Word and Outlook to spread.

This has been fixed. In its default configuration, all recent versions of Office won't run macros unless the user explicitly tells them to do it.

So, what's the point of "Protected View"?

Files from "untrusted" locations (such as e-mail attachments) have a higher probability of containing malware than files from your local documents folder. Thus, when opening those files, Office adds an additional layer of security by activating "Protected View":

• You now have to confirm twice before macros can be executed (first to "Enable Editing", then to "Run macros") and, more importantly,
• non-essential features are disabled. These features (like editing, saving and printing) are generally considered "safe", but, like all software components, they can contain bugs. By disabling them, Office reduces the attack surface.

The latter point is not just theoretical: There have been bugs (e.g. CVE-2021-40444) which could only be exploited outside of "Protected View".

Answer 3

Unfortunately, you can't sort, filter, or do lots of other "view only" types of operations. Also, what about imbedded objects? Are things enabled by "Enable editing" or is this really a belt-and-suspenders type of double authorization that has no effect if you don't also enable macros. What is the best way to enable enhaced viewing features without enabling any harmful macros or embedded objects? I suppose I could save as csv and then reopen in excel for simple spreadsheets.