(usda loan mortgage companies, qualifications for a conventional mortgage loan, mortgage home loan process, va mortgage loan credit score requirements, what is the mortgage rate for a va loan, how to apply for a va mortgage loan, mortgage loan omaha, movement mortgage va loan, sierra pacific mortgage my home loan, when to refinance mortgage loan, how much is a jumbo mortgage loan, mortgage loan options for first time home buyers, mortgage loan income to debt ratio, what does it take to be a mortgage loan officer, refinance mortgage and equity loan, qualify for a fha mortgage loan, second mortgage or home equity loan, advantages of a va mortgage loan, va mortgage loan closing costs, apply for mortgage loan online with bad credit, mortgage loan disclosures within 3 days, how to get home mortgage loan, federal home loan mortgage company, prequalify for mortgage loan online, refinance mortgage vs home equity loan, citigroup mortgage loan trust inc phone number, mortgage loan pre approval online, mortgage loan expenses, apply online for mortgage loan, second mortgage loan companies, harp loan second mortgage, fha loan without mortgage insurance, home loan mortgage broker, can i refinance my mortgage and home equity loan together, what is the maximum loan amount for a reverse mortgage, 200k loan mortgage, can i get a home improvement loan with my mortgage, 21st mortgage loan requirements, no mortgage home equity loan, pre approved mortgage but denied loan, bank or mortgage company for home loan, mortgage loan grants, va loan mortgage companies, 100 loan to value mortgage refinance, mortgage loan rate vs apr, veterans mortgage loan, estimate mortgage loan approval amount, who can get a va mortgage loan, is a home equity loan the same as a mortgage, va mortgage loan eligibility, difference between mortgage and home loan, reverse mortgage loan rates, reverse mortgage home loan, reverse mortgage loan scheme sbi, best cheapest car insurance company, who is the best car insurance company for young drivers, best term insurance company, best online car insurance company, best insurance company for drivers with points, best cheap car insurance company, best company for auto insurance, best cheapest auto insurance company, best car insurance company for new drivers, best company for car insurance, cheapest best auto insurance company, which is the best insurance company for auto, what is the best home and auto insurance company, what is the best and cheapest auto insurance company, best and cheapest car insurance company, best company for home and auto insurance, navigators insurance company am best rating, best car insurance company 2015, what is the best insurance company for auto, best car insurance company california, what is the cheapest and best car insurance company, best car insurance company in california, best online insurance company, who is the best rated auto insurance company, best insurance company for auto and home, automotive accident lawyers, accident automotive, automotive insurance company, cheap automotive insurance, automotive insurance, automotive insurance quotes, automotive insurance new york, automotive insurance companies, automotive certification online)

Windows Mark of the Web Zero-Days Remain Patchless, Under Exploit

Two separate vulnerabilities exist in different versions of Windows that allow attackers to smuggle malicious attachments and files past Microsoft’s Mark of the Web (MOTW) security feature.

Attackers are actively exploiting both issues, according to Will Dormann, a former software vulnerability analyst at the CERT Coordination Center (CERT/CC) at Carnegie Mellon University, who discovered the two flaws. But Microsoft hasn’t released any fixes for them so far, and there are no known workarounds available for companies to protect themselves, says the researcher, who is credited with discovering numerous zero-day vulnerabilities throughout his career.

MotW protection for untrusted files

MotW is a Windows feature designed to protect users from files from untrusted sources. The tag itself is a hidden tag that Windows attaches to files downloaded from the Internet. Files bearing the MotW tag are restricted in their functionality and functionality. For example, starting with MS Office 10, MotW-tagged files are opened in Protected View by default, and executable files are first checked for security issues by Windows Defender before they are allowed to run.

“Many Windows security features — [such as] Microsoft Office Protected View, SmartScreen, Smart App Control, [and] Warning dialogs – rely on the presence of the MotW to work,” Dormann, who is currently Senior Vulnerability Analyst at Analygence, told Dark Reading.

Bug 1: MotW .ZIP bypass, with unofficial patch

Dormann reported the first of the two MotW bypass issues to Microsoft on July 7th. According to him, Windows does not apply the MotW to files extracted from specially crafted .ZIP files.

“Any file contained within a .ZIP file can be configured not to include MOTW marks when extracted,” says Dorman. “This allows an attacker to have a file that functions in a way that makes it appear as if it didn’t come from the Internet.” This makes it easier for them to trick users into running arbitrary code on their systems, Dormann notes.

Dormann says he cannot share details of the bug because it would reveal how attackers could exploit the flaw. But he says it affects all Windows versions from XP onwards. He says one reason he hasn’t heard from Microsoft is likely because the vulnerability was reported to them through CERT’s Vulnerability Information and Coordination Environment (VINCE), a platform he says Microsoft has rejected.

“I haven’t worked at CERT since late July, so I can’t say if Microsoft has attempted to contact CERT in any way since July,” he warns.

According to Dormann, other security researchers have reported that attackers are actively exploiting the flaw. One of them is security researcher Kevin Beaumont, a former threat intelligence analyst at Microsoft. In a tweet thread earlier this month, Beaumont reported that the bug had been exploited in the wild.

“It is without a doubt The dumbest zero day I’ve worked on‘ Beaumont said.

In a separate tweet a day later, Beaumont said he wanted to publish detection guidelines for the issue but was concerned about the possible consequences.

“If Emotet/Qakbot/etc find it, they will 100% use it extensively,” he warned.

Microsoft has not responded to two dark reading requests asking for comment on Dormann’s reported vulnerabilities or if it had any plans to fix them, but Slovenia-based security firm Acros Security released an unofficial patch for these last week first vulnerability released via its 0patch patch platform.

In a comment to Dark Reading, Mitja Kolsek, CEO and co-founder of 0patch and Acros Security, says he was able to confirm the vulnerability Dormann reported to Microsoft in July.

“Yes, it’s ridiculously obvious once you know. That’s why we didn’t want to reveal any details,” he says. He says that the code that performs the unpacking of .ZIP files is buggy and only a code patch can fix it. “There are no workarounds,” says Kolsek.

Kolsek says the issue isn’t difficult to exploit, but he adds that the vulnerability alone isn’t enough for a successful attack. To successfully exploit, an attacker would still need to convince a user to open a file in a maliciously crafted .ZIP archive – sent as an attachment via a phishing email or, for example, from a removable storage device such as a USB stick is copied.

“Normally, any files extracted from a .ZIP archive tagged with MotW would also get that mark and therefore would trigger a security warning upon opening or launching it,” he says, but the vulnerability definitely gives attackers a way bypass the protection. “We are not aware of any mitigating circumstances,” he adds.

Mistake 2: Sneaking past MotW with corrupted Authenticode signatures

The second vulnerability concerns the handling of files with MotW tags that have corrupted Authenticode digital signatures. Authenticode is a code signing technology from Microsoft that authenticates the identity of the publisher of a given piece of software and whether the software has been tampered with after it was released.

Dormann says he discovered that a file with a bad Authenticode signature is treated by Windows as if it didn’t have MotW; The vulnerability causes Windows to skip SmartScreen and other warning dialogs before executing a JavaScript file.

“Windows doesn’t seem to open when an error occurs [when] Processing of Authenticode data,” says Dormann, and “it will no longer apply MotW protection to Authenticode-signed files, although they actually still retain the MotW.”

Dormann describes that the problem affects all versions of Windows from version 10, including the server variant of Windows Server 2016. The vulnerability gives attackers a way to corruptly sign any file that can be signed by Authenticode – for example . exe files and JavaScript files – and sneak it past MOTW protection.

Dormann says he learned about the issue after reading an HP Threat Research blog earlier this month about a Magniber ransomware campaign targeting an exploit for the flaw.

It’s unclear if Microsoft is taking any action, but researchers are continuing to sound the alarm for now. “I haven’t received an official response from Microsoft, but at the same time I haven’t officially reported the issue to Microsoft because I’m no longer a CERT employee,” says Dormann. “I announced it publicly via Twitter because the vulnerability is being exploited by attackers in the wild.”

Leave a Reply

Your email address will not be published. Required fields are marked *

| |
Back to top button