Windows: 0Patch micropatch for MotW bypassing 0-day (no CVE)Born's Tech and Windows World

Sicherheit (Pexels, allgemeine Nutzung) [German]A new bug in Windows has been known for a few days that prevents the "Mark of the Web" flag from being evaluated for broken signatures. Microsoft itself has not yet released a patch for this 0-day vulnerability. The vulnerability is already being exploited. Therefore, ACROS Security has addressed the problem and developed a 0Patch micropatch to close it. The patch is freely available, only the 0patch agent is needed.

Advertising

I reported about the issue 2 days ago in the blog post Windows 0-day (Mark of the Web) used for ransomware attacks via JavaScript. There is no patch for this vulnerability from Microsoft yet. Mitja Kolsek, the founder of ACROS Security informed me about this micropatch in a personal message a few hours ago, but also made the whole thing public in the following tweet as well as the details in this blog post.

What is MOTW about?

Windows can display a security warning before opening and starting an executable file downloaded from the Internet. This warning, e.g. through "Smart App Control" only works for files that have the Mark of the Web (MOTW) flag set. Smart App Control is intended to provide better protection against new and emerging threats in Windows 11 by blocking malicious or untrusted apps. Smart App Control also helps block potentially unwanted apps. Microsoft Office also blocks macros in documents with MOTW (source).

However, there is a bug in Windows that prevents this MotW flag from being evaluated at all. This is triggered by a broken digital signature in the file being checked. I had pointed this out in the blog post Windows 0-day (Mark of the Web) used for ransomware attacks via JavaScript.

Microsoft itself has not yet released a patch for this 0-day vulnerability. The vulnerability is already being exploited. This is now the second unpatched vulnerability in this area (see Windows: 0Patch Micropatch for MOTOW ZIP file bug (0-day, no CVE)).

The 0Patch solution

ACROS Security has analyzed the vulnerability and released micropatches for it. These are available for free via the 0patch agent until Microsoft has released the official fix. Details on how it works can be read in this blog post. Notes on how the 0patch agent works, which loads the micropatches into memory at an application's runtime, can be found in blog posts (such as here).

Advertising

Advertising

Windows: 0Patch micropatch for MotW bypassing 0-day (no CVE)

What is MOTW about?

The 0Patch solution

Leave a Reply Cancel reply

Blogs

Links

Social networks

Awards

Sponsors

Recent Comments

Recent Comments

Meta