If you think your network of Windows computers is safe from malware because you’ve set up Applocker to whitelist only trusted apps, we have some bad news.
A newly discovered security flaw allows users to get around this on business editions of Windows (Windows 7 and up) by using Regsvr32. You can point it to a remotely hosted file or script to run any app you want on your system.
That exposes PCs to the danger of running malicious software even if AppLocker is installed. And as it doesn’t require administrator access or alter the system registry, it’s hard to trace.
The vulnerability was discovered last week by Colorado-based Casey Smith, who blogged about his findings and published proof-of-concept scripts to demonstrate it on GitHub.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
Microsoft is yet to issue a patch to fix this. CSO notes that for the time being, you can disable Regsvr32.exe and Regsvr64.exe’s network awareness using Windows Firewall.
We’ve contacted Microsoft and will update this post when we hear back.
via Engadget
Get the TNW newsletter
Get the most important tech news in your inbox each week.