Windows Mark of the Web Zero-Days Remain Patchless, Under Exploit

Two separate vulnerabilities exist in different versions of Windows that allow attackers to smuggle malicious attachments and files past Microsoft’s Mark of the Web (MOTW) security feature.

Attackers are actively exploiting both issues, according to Will Dormann, a former software vulnerability analyst at the CERT Coordination Center (CERT/CC) at Carnegie Mellon University, who discovered the two flaws. But Microsoft hasn’t released any fixes for them so far, and there are no known workarounds available for companies to protect themselves, says the researcher, who is credited with discovering numerous zero-day vulnerabilities throughout his career.

MotW protection for untrusted files

MotW is a Windows feature designed to protect users from files from untrusted sources. The tag itself is a hidden tag that Windows attaches to files downloaded from the Internet. Files bearing the MotW tag are restricted in their functionality and functionality. For example, starting with MS Office 10, MotW-tagged files are opened in Protected View by default, and executable files are first checked for security issues by Windows Defender before they are allowed to run.

“Many Windows security features — [such as] Microsoft Office Protected View, SmartScreen, Smart App Control, [and] Warning dialogs – rely on the presence of the MotW to work,” Dormann, who is currently Senior Vulnerability Analyst at Analygence, told Dark Reading.

Bug 1: MotW .ZIP bypass, with unofficial patch

Dormann reported the first of the two MotW bypass issues to Microsoft on July 7th. According to him, Windows does not apply the MotW to files extracted from specially crafted .ZIP files.

“Any file contained within a .ZIP file can be configured not to include MOTW marks when extracted,” says Dorman. “This allows an attacker to have a file that functions in a way that makes it appear as if it didn’t come from the Internet.” This makes it easier for them to trick users into running arbitrary code on their systems, Dormann notes.

Dormann says he cannot share details of the bug because it would reveal how attackers could exploit the flaw. But he says it affects all Windows versions from XP onwards. He says one reason he hasn’t heard from Microsoft is likely because the vulnerability was reported to them through CERT’s Vulnerability Information and Coordination Environment (VINCE), a platform he says Microsoft has rejected.

“I haven’t worked at CERT since late July, so I can’t say if Microsoft has attempted to contact CERT in any way since July,” he warns.

According to Dormann, other security researchers have reported that attackers are actively exploiting the flaw. One of them is security researcher Kevin Beaumont, a former threat intelligence analyst at Microsoft. In a tweet thread earlier this month, Beaumont reported that the bug had been exploited in the wild.

“It is without a doubt The dumbest zero day I’ve worked on‘ Beaumont said.

In a separate tweet a day later, Beaumont said he wanted to publish detection guidelines for the issue but was concerned about the possible consequences.

“If Emotet/Qakbot/etc find it, they will 100% use it extensively,” he warned.

Microsoft has not responded to two dark reading requests asking for comment on Dormann’s reported vulnerabilities or if it had any plans to fix them, but Slovenia-based security firm Acros Security released an unofficial patch for these last week first vulnerability released via its 0patch patch platform.

In a comment to Dark Reading, Mitja Kolsek, CEO and co-founder of 0patch and Acros Security, says he was able to confirm the vulnerability Dormann reported to Microsoft in July.

“Yes, it’s ridiculously obvious once you know. That’s why we didn’t want to reveal any details,” he says. He says that the code that performs the unpacking of .ZIP files is buggy and only a code patch can fix it. “There are no workarounds,” says Kolsek.

Kolsek says the issue isn’t difficult to exploit, but he adds that the vulnerability alone isn’t enough for a successful attack. To successfully exploit, an attacker would still need to convince a user to open a file in a maliciously crafted .ZIP archive – sent as an attachment via a phishing email or, for example, from a removable storage device such as a USB stick is copied.

“Normally, any files extracted from a .ZIP archive tagged with MotW would also get that mark and therefore would trigger a security warning upon opening or launching it,” he says, but the vulnerability definitely gives attackers a way bypass the protection. “We are not aware of any mitigating circumstances,” he adds.

Mistake 2: Sneaking past MotW with corrupted Authenticode signatures

The second vulnerability concerns the handling of files with MotW tags that have corrupted Authenticode digital signatures. Authenticode is a code signing technology from Microsoft that authenticates the identity of the publisher of a given piece of software and whether the software has been tampered with after it was released.

Dormann says he discovered that a file with a bad Authenticode signature is treated by Windows as if it didn’t have MotW; The vulnerability causes Windows to skip SmartScreen and other warning dialogs before executing a JavaScript file.

“Windows doesn’t seem to open when an error occurs [when] Processing of Authenticode data,” says Dormann, and “it will no longer apply MotW protection to Authenticode-signed files, although they actually still retain the MotW.”

Dormann describes that the problem affects all versions of Windows from version 10, including the server variant of Windows Server 2016. The vulnerability gives attackers a way to corruptly sign any file that can be signed by Authenticode – for example . exe files and JavaScript files – and sneak it past MOTW protection.

Dormann says he learned about the issue after reading an HP Threat Research blog earlier this month about a Magniber ransomware campaign targeting an exploit for the flaw.

It’s unclear if Microsoft is taking any action, but researchers are continuing to sound the alarm for now. “I haven’t received an official response from Microsoft, but at the same time I haven’t officially reported the issue to Microsoft because I’m no longer a CERT employee,” says Dormann. “I announced it publicly via Twitter because the vulnerability is being exploited by attackers in the wild.”