BEST OF THE WEB

Unofficial patch for Windows MotW Zero-Day released

A cybersecurity company has released a free unofficial patch to fix an actively exploited Windows bug that allows files signed with erroneous signatures to avoid Mark-of-the-Web security warnings in Windows 10 and 11.

Previously, the threat actors used standalone JavaScript files to install the Magniber ransomware on the devices of the victims, especially on home PCs.

When a user downloads a file from the Internet, Microsoft adds a Mark-of-the-Web flag to the file, which causes the operating system to display security warnings when the file is opened. Magniber JavaScript files stand out because they contain a Mark-of-a-Web, and when they were launched, Windows did not display any security warnings.

It turns out that it is possible to bypass this feature and not attach the MotW flag to files downloaded from the Internet, thus bypassing all protection mechanisms when opening them. For example, an attacker could prevent Windows from placing the MotW flag on files extracted from an untrusted ZIP archive. Scammers could exploit this vulnerability to cause users to open ZIP archives and execute malicious software without triggering the expected security precautions.

Since this zero-day vulnerability is actively used for ransomware attacks, the micro-patching service 0patch has decided to release an unofficial fix that can be used until Microsoft releases an official security update.

A Microsoft spokesman said of the latest vulnerability: “We are aware of the technique and are investigating to determine the appropriate steps to address the issue.”

The sources for this piece include an article in TheRegister.

IT World Canada Staff
IT World Canada Staffhttp://www.itworldcanada.com/
The online resource for Canadian Information Technology professionals.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web