Turns out Microsoft Defender had a rather embarassing security flaw of its own

Microsoft appears to have quietly fixed a decade-old vulnerability in its Windows antivirus software weeks after reports first emerged.

Initial news reports described a Microsoft Defender flaw that allowed an attacker to run virtually any malware, without triggering the antivirus program’s alarms. 

The flaw is quite simple in theory, and focuses on planting malware where Microsoft Defender is not permitted to peek. Some programs trigger a false positive alert, and as such, need to be excluded from the scan. One way Defender users do this is by adding certain locations, either locally, or on a network, that get excluded from the scan. 

Shutting the doors

The problem with this approach was that the Registry key containing the list of the excluded locations was accessible by the “Everyone” group, meaning local users, regardless of their permissions, could easily access it.

Knowing where Defender can’t look, planting dangerous malware suddenly gets super easy.

The flipside to this coin is that for the flaw to be abused, the malicious actor needs to have local access, in advance. Still, that doesn’t matter too much, as many malicious actors who’ve already compromised certain endpoints and networks, can use the flaw to allow stealthy lateral movement. 

However, a cybersecurity expert going by the name SecGuru_OTX confirmed the vulnerability no longer works, BleepingComputer found. Soon after, Antonio Cocomazzi of SentinelOne also confirmed the issue has been fixed with the February 2022 Patch Tuesday Windows update.

At the same time, cybersecurity analyst Will Dormann of CERT/CC claims he spotted some Windows permissions change without any updates being installed, suggesting that the change might have come from Microsoft Defender itself, and not through the update to the OS. 

The vulnerability was found to affect Windows 10 21H1 and Windows 10 21H2 users, but Windows 11 is safe.

Via: BleepingComputer