A vulnerability in Windows Defender went unnoticed for 12 years

[Joe White]

Facepalm: A critical bug in Windows Defender went undetected by both attackers and defenders for some 12 years, before finally being patched last fall. The vulnerability in Microsoft’s built-in antivirus software could have allowed hackers to overwrite files or execute malicious code—if the bug had been found.

Let’s be clear—12 years is a long time when it comes to the lifecycle of a mainstream operating system, and it’s a heck of a long time for such a critical vulnerability to hide. Part of the reason for this could be because the bug in question doesn’t actively exist on a computer’s storage—instead, it exists in a Windows system called a “dynamic-link library.” Windows Defender only loads this driver when needed, before wiping it off a computer’s disk.

Wired explains, “When the driver removes a malicious file, it replaces it with a new, benign one as a sort of placeholder during remediation. But the researchers discovered that the system doesn't specifically verify that new file. As a result, an attacker could insert strategic system links that direct the driver to overwrite the wrong file or even run malicious code.”

Researchers at security firm SentinelOne discovered and reported the flaw last fall, which was subsequently patched.

Microsoft initially rated the vulnerability as “high,” although it’s worth noting that for an attacker to take advantage of the bug, they’d need access—either physical or remote—to your computer. In all likelihood, this means that additional exploits would probably need to be deployed.

Both Microsoft and SentinelOne also agree that there’s no evidence that the now-patched bug was exploited maliciously. And SentinelOne is keeping the specifics of the vulnerability under their hat in order to prevent hackers from taking advantage of the bug while the patch rolls-out.

A Microsoft spokesperson said that anyone who installed the Feb. 9 patch, either manually or via auto-updates, is protected.

Permalink to story.

https://www.techspot.com/news/88626-vulnerability-windows-defender-went-unnoticed-12-years.html

 

[noel24]

Windows is a joke for the last 6 years. In the meantime, Sir William Gates paints Himself as The Humanity's Savior because 6 years ago He envisioned that a strain of coronavirus that were hitting Earth every few years since 1918 (Spanish flu) will eventually strike back in 2020s. If It wasn't that the last year's strain was a nasty one, He could not make all those interviews that make His celebrity status resurrected. Excellent job, Your Majesty!

Hey, since the population of Earth is growing especially in Asia, and distances between people shrink all the times, and half of developing world still live around both domestic animals and eat wild animals, I envision that one of the next covid strains will kill around twice the people that COVID19 will. When it happens, don't forget who to call for intereview! Of course, I cannot guarantee I'll be available...

Really, MS should spend little more dough on testing.
Eventually They will loose this part of business to competition.

 

[TheBigT42]

That's why it isn't running on my workstation or servers.

 

[ilovelinux]

Windows Offender is the righteous name.

 

[Uncle Al]

Sigh .... another Microsoft "undocumented feature" ......

 

[oldikes]

Windows is a joke for the last 6 years. In the meantime, Sir William Gates paints Himself as The Humanity's Savior because 6 years ago He envisioned that a strain of coronavirus that were hitting Earth every few years since 1918 (Spanish flu) will eventually strike back in 2020s. If It wasn't that the last year's strain was a nasty one, He could not make all those interviews that make His celebrity status resurrected. Excellent job, Your Majesty!

Hey, since the population of Earth is growing especially in Asia, and distances between people shrink all the times, and half of developing world still live around both domestic animals and eat wild animals, I envision that one of the next covid strains will kill around twice the people that COVID19 will. When it happens, don't forget who to call for intereview! Of course, I cannot guarantee I'll be available...

Really, MS should spend little more dough on testing.
Eventually They will loose this part of business to competition.

Sir this is a wendys

 

[Bulllee]

Sir this is a wendys

Great riposte,I'm still laughing.

 

[noel24]

Great riposte,I'm still laughing.

Ok, I don't know the meme. Any reference?

 

[Bulllee]

Ok, I don't know the meme. Any reference?

Was just a bit humour for the weekend.

 

[candle_86]

Windows is a joke for the last 6 years. In the meantime, Sir William Gates paints Himself as The Humanity's Savior because 6 years ago He envisioned that a strain of coronavirus that were hitting Earth every few years since 1918 (Spanish flu) will eventually strike back in 2020s. If It wasn't that the last year's strain was a nasty one, He could not make all those interviews that make His celebrity status resurrected. Excellent job, Your Majesty!

Hey, since the population of Earth is growing especially in Asia, and distances between people shrink all the times, and half of developing world still live around both domestic animals and eat wild animals, I envision that one of the next covid strains will kill around twice the people that COVID19 will. When it happens, don't forget who to call for intereview! Of course, I cannot guarantee I'll be available...

Really, MS should spend little more dough on testing.
Eventually They will loose this part of business to competition.

Gates had nothing to do with this,also an undocumented unknown exploit fixed a year ago hardly seems damning, new exploits are found in everything, but unlike apple when Microsoft is made aware they fix it instead of saying it's fine our systems are perfect

 

[YHWACH]

Windows is a joke for the last 6 years. In the meantime, Sir William Gates paints Himself as The Humanity's Savior because 6 years ago He envisioned that a strain of coronavirus that were hitting Earth every few years since 1918 (Spanish flu) will eventually strike back in 2020s. If It wasn't that the last year's strain was a nasty one, He could not make all those interviews that make His celebrity status resurrected. Excellent job, Your Majesty!

Hey, since the population of Earth is growing especially in Asia, and distances between people shrink all the times, and half of developing world still live around both domestic animals and eat wild animals, I envision that one of the next covid strains will kill around twice the people that COVID19 will. When it happens, don't forget who to call for intereview! Of course, I cannot guarantee I'll be available...

Really, MS should spend little more dough on testing.
Eventually They will loose this part of business to competition.

This myth people talk about 'overpopulation' is just as dumb as flat earth theory. The earth can comfortably hold 10 times the current population, the problem is not space, it's our simplistic agricultural practices which waste land and waste of other resources. If all humans on earth where to stand shoulder to shoulder we would fit in manhattan, all 7 billion of us.

 

[Squid Surprise]

Once again, the MS haters come out... There are almost certainly unexploited exploits in EVERY SINGLE OS IN EXISTENCE!!

They get found all the time - get reported - and then get patched. This is true for unix/linux, Windows, MacOS, iOS, Android and all the rest.

That no one saw this one in 12 years clearly means it was pretty tough to find. Windows, by being the most popular OS on PC, gets searched for exploits more than any other.

People love to hate on MS - but they do a pretty good job of securing their OS. People who say "*nix is far more secure" don't know what they're talking about. It's open source, and there are tons of undocumented exploits that hackers use all the time...

 

[mgwerner]

Could it be that so few people use Defender, no one noticed?

 

[scavengerspc]

Once again, the MS haters come out... There are almost certainly unexploited exploits in EVERY SINGLE OS IN EXISTENCE!!

They get found all the time - get reported - and then get patched. This is true for unix/linux, Windows, MacOS, iOS, Android and all the rest.

That no one saw this one in 12 years clearly means it was pretty tough to find. Windows, by being the most popular OS on PC, gets searched for exploits more than any other.

People love to hate on MS - but they do a pretty good job of securing their OS. People who say "*nix is far more secure" don't know what they're talking about. It's open source, and there are tons of undocumented exploits that hackers use all the time...

Honestly, I can't think of one other software company that would be able to handle a fraction of the exploit attempts that are thrown at MS\Windows every single day.

 

[Wasteak]

It's so funny to see people saying "windows is such a joke" while they dont understand that discovering a vulnerability years later means that it never has been exploited.
(oh and btw the os with the most security breaches every year isnt window (hey apple whats up?)

 

[Puiu]

Windows Offender is the righteous name.

It's still much better than many of the "free" AVs. And this is saying a lot about how far they've managed to get with windows defender.

 

[wiyosaya]

Par for the course. I wonder if there are any hackers out there who are embarrassed that they did not find and exploit this?

 

[candle_86]

Par for the course. I wonder if there are any hackers out there who are embarrassed that they did not find and exploit this?

If they'd found it 12 years ago it would have been patched 12 years ago.

 

[Reehahs]

Sigh .... another Microsoft "undocumented feature" ......

It's a feature until it is used to bug someone.

 

[Fox God Records]

Sir this is a wendys

No, this is Patrick!

 

[Markoni35]

I bet some attackers knew about the vulnerability.
Those who ordered it in the first place.
Or... maybe the person who ordered it got fired, took his stuff, and NSA really didn't know about it. LOL.

 

[Puiu]

I bet some attackers knew about the vulnerability.
Those who ordered it in the first place.
Or... maybe the person who ordered it got fired, took his stuff, and NSA really didn't know about it. LOL.

even if they knew of this vulnerability, they would need to access the computer to make it work... at that point he can install pretty much anything.

 

[comnut]

"nobody got fired for buying blue boxes" ..... Its a shame really, I bet almost no one knows what that means... :O

 

[Vanderlinde]

The whole reason for MS defender to exist was due to the large large large amount of infected XP, W7 and W8 machines out there.

 

[cliffordcooley]

The whole reason for MS defender to exist was due to the large large large amount of infected XP, W7 and W8 machines out there.

Defender started out as a firewall and then with Win8 incorporated Microsoft Security Essentials. Defender on WinXP, WinVista, and Win7 did/does not scan for viruses. And when talking about Defender anti-virus abilities, you can not isolate Win10 from Win8.

Microsoft Security Essentials - Wikipedia

en.wikipedia.org

Microsoft Security Essentials (MSE) is an antivirus software (AV) that provides protection against different types of malicious software, such as computer viruses, spyware, rootkits, and trojan horses. Prior to version 4.5, MSE ran on Windows XP, Windows Vista, and Windows 7, but not on Windows 8 and later versions, which have built-in AV components known as Windows Defender.