Google: Microsoft's Windows Security Could Be Hacked With One Unopened Email

It didn't even need opening, just for it to be sent to the Windows machine was enough for the hack to work, Google Project Zero researchers Natalie Silvanovich and Tavis Ormandy reported today.

Ormandy had already described the bug as "crazy bad" and "the worst [of its kind] in recent memory." In a full technical description of the bug, he wrote: "Vulnerabilities in MsMpEng [Microsoft Malware Protection Engine] are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service."

Fortunately, Microsoft has rushed out a patch and all PCs running the vulnerable tool should receive an update today. "If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned," the company wrote in its advisory. "If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.

"The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files."

Microsoft said the update should download automatically and users need not download anything. They can check they received the patch by following the instructions in the company's advisory.

What's the bug?

The issue lay in NScript - a component of Microsoft Malware Protection Engine that analyzes filesystems and network activity that looks like JavaScript. In parsing code, NScript didn't properly validate what information it was running, in what's known as a "type confusion" bug. An attacker was therefore able to hide malicious code in anything scanned by software, such as an incoming email or files served by a website. The vulnerability could be exploited on unpatched Windows 8, 8.1, 10 and Windows Server systems.

Ormandy noted that "there is no practical way to identify an exploit at the network level, and administrators should patch as soon as is practically possible."

"It looks fairly severe," added co-founder of Hacker House Matthew Hickey. "The [proof-of-concept hack] demonstrates remote code execution capability in various scenarios: you could exploit a system by uploading a file to [a] web server or sending an email to a Microsoft desktop. The malware protection service is enabled by default in Windows 8 and up. It's a very critical bug.

"It seems this malware protection service might be an Achilles heel in Microsoft security model and system owners should consider disabling it."

Despite the severity, Microsoft is receiving praise for how quickly it dealt with the bug, proving the value of the disclosure process...

Still blown away at how quickly @msftsecurity responded to protect users, can't give enough kudos. Amazing.

— Tavis Ormandy (@taviso) May 9, 2017