Microsoft appears to have quietly fixed a decade-old vulnerability in its Windows antivirus software weeks after reports first emerged.
Initial news reports described a Microsoft Defender flaw that allowed an attacker to run virtually any malware, without triggering the antivirus program’s alarms.
The flaw is quite simple in theory, and focuses on planting malware (opens in new tab) where Microsoft Defender is not permitted to peek. Some programs trigger a false positive alert, and as such, need to be excluded from the scan. One way Defender users do this is by adding certain locations, either locally, or on a network, that get excluded from the scan.
Shutting the doors
The problem with this approach was that the Registry key containing the list of the excluded locations was accessible by the “Everyone” group, meaning local users, regardless of their permissions, could easily access it.
Knowing where Defender can’t look, planting dangerous malware suddenly gets super easy.
The flipside to this coin is that for the flaw to be abused, the malicious actor needs to have local access, in advance. Still, that doesn’t matter too much, as many malicious actors who’ve already compromised certain endpoints (opens in new tab) and networks, can use the flaw to allow stealthy lateral movement.
> Windows 10 antivirus weakness lets attackers evade detection (opens in new tab)
> Is Microsoft Defender good enough for your PC – or do you need a better free antivirus? (opens in new tab)
> The all-new version of Microsoft Defender Preview is available now, for free (opens in new tab)
However, a cybersecurity expert going by the name SecGuru_OTX confirmed the vulnerability no longer works, BleepingComputer found. Soon after, Antonio Cocomazzi of SentinelOne also confirmed the issue has been fixed with the February 2022 Patch Tuesday Windows update.
At the same time, cybersecurity analyst Will Dormann of CERT/CC claims he spotted some Windows permissions change without any updates being installed, suggesting that the change might have come from Microsoft Defender itself, and not through the update to the OS.
The vulnerability was found to affect Windows 10 21H1 and Windows 10 21H2 users, but Windows 11 is safe.
- Here's our list of the best firewalls (opens in new tab) right now
Via: BleepingComputer (opens in new tab)
