Microsoft has addressed a critical zero-day vulnerability affecting its Windows Smart App Control (SAC) and SmartScreen security features.

This vulnerability was fixed at Microsoft’s September 2024 Patch Tuesday, which addressed a significant number of security vulnerabilities, including four zero-day exploits and 79 vulnerabilities across various products.

This vulnerability, identified as CVE-2024-38217, has been actively exploited by threat actors since 2018, highlighting the persistent challenges in maintaining robust cybersecurity defenses.

The vulnerability, classified as a “Security Feature Bypass,” allows attackers to evade the Mark of the Web (MOTW) protections. MOTW is a security mechanism designed to flag files downloaded from the internet, prompting additional security checks. By bypassing these checks, attackers can execute malicious code on a victim’s system with minimal interference.

Exploitation Details

Cybersecurity researchers at Elastic Security Labs discovered that attackers have been using sophisticated techniques to bypass SAC and SmartScreen defenses. These methods include:

Seeding: Attackers disguise malware as benign binaries, which later activate malicious code. This technique exploits SAC’s vulnerability to basic anti-emulation tactics.
Reputation Tampering: By manipulating file reputations, attackers can maintain a trusted status for compromised files. This is possible due to SAC’s reliance on unclear hashing or machine learning-based similarity comparisons.
MOTW Bypasses: Specially crafted LNK files can remove MOTW labels before security checks, allowing malicious code execution. This technique involves manipulating file paths to evade detection.

“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as SmartScreen Application Reputation security check and/or the legacy Windows Attachment Services security prompt.”

These vulnerabilities have been exploited in the wild, with some methods dating back six years, underscoring the need for continuous improvement in security measures.

Microsoft’s Response

Microsoft has released an official fix for CVE-2024-38217, addressing the exploitability of this vulnerability. The fix is crucial for users of Windows 11, version 24H2, particularly those using new Copilot+ devices that come pre-installed with this version.

Although Windows 11, version 24H2, is not yet generally available, Microsoft has ensured that updates are accessible to affected users.

The exploitation of this zero-day vulnerability highlights the ongoing battle between security developers and cybercriminals. Reputation-based security systems like SAC and SmartScreen are not foolproof, and attackers continue to devise methods to bypass these defenses.

To mitigate such threats, cybersecurity experts recommend:

Developing Behavioral Signatures: Focus on creating behavioral signatures for commonly abused software categories.
Monitoring Downloaded Files: Pay close attention to files downloaded to non-standard locations, which may indicate malicious activity.
LNK File Alterations: Monitor changes made by explorer.exe to LNK files, as these could suggest MOTW bypass attempts.

Ultimately, while reputation-based defenses are essential, they must be complemented by robust behavioral monitoring to effectively combat advanced threats.

As Microsoft continues to enhance its security features, users are urged to stay informed about updates and apply patches promptly to protect their systems from emerging vulnerabilities.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

The post Windows Smart App Control Zero-Day (CVE-2024-38217) Exploited Since 2018 Finally Fixed appeared first on Cyber Security News.