Windows 11 | Windows 10 Modifying => Patch Tuesday| Updates | Security | Privacy | Anti-virus => Topic started by: javajolt on October 18, 2022, 10:20:52 AM
Title: Windows Mark of the Web bypass zero-day gets unofficial patch
Post by: javajolt on October 18, 2022, 10:20:52 AM
A free unofficial patch has been released through the 0patch platform to address an actively exploited zero-day flaw in the Windows Mark of the Web (MotW) security mechanism.
This flaw enables attackers to prevent Windows from applying (MotW) labels on files extracted from ZIP archives downloaded from the Internet.
Windows automatically adds MotW flags to all documents and executables downloaded from untrusted sources, including files extracted from downloaded ZIP archives, using a special 'Zone.Id' alternate data stream.
These MotW labels tell Windows, Microsoft Office, web browsers, and other apps that the file should be treated with suspicion and will cause warnings to be displayed to the user that opening the files could lead to dangerous behavior, such as malware being installed on the device.
Will Dormann, a senior vulnerability analyst at ANALYGENCE, who first spotted ZIP archives not properly adding MoTW flags, reported the issue to Microsoft in July.
Although Microsoft opened and read the report more than two months ago, in August, the company hasn't yet released a security update to fix the flaw.
As ACROS Security CEO and co-founder of the 0patch micropatching service Mitja Kolsek explains, MotW is an essential Windows security mechanism since Smart App Control will only work on files with MotW flags and Microsoft Office will only block macros on documents tagged with MotW labels.
"Attackers therefore understandably prefer their malicious files not being marked with MOTW; this vulnerability allows them to create a ZIP archive such that extracted malicious files will not be marked," Kolsek said.
"An attacker could deliver Word or Excel files in a downloaded ZIP that would not have their macros blocked due to the absence of the MOTW (depending on Office macro security settings), or would escape the inspection by Smart App Control."
Free micropatches until Microsoft releases a fix
Since the zero-day was reported to Microsoft in July, it has been detected as exploited in attacks to deliver malicious files on victims' systems.