Security researchers have just revealed a new unpatched bug that allows attackers to circumvent Windows 10 S' Device Guard feature, which locks the OS to only running whitelisted software.
- Google's Project Zero security researchers have revealed an unpatched bug that bypasses Device Guard app whitelisting.
- Device Guard app whitelisting was a major security feature in the Window 10 S OS, whose protections will be now made available throughout Windows 10 as S Mode.
When Windows 10 S was launched by Microsoft last year, the security-focused OS was marketed as being invulnerable to any "known ransomware".
While Windows 10 S will no longer be a separate operating system, its protections will instead soon be rolled out
to every Windows 10 edition as part of a new S Mode.
However, security researchers have just revealed a new unpatched bug that allows attackers to circumvent Windows 10 S' Device Guard feature, which locks the OS to only running whitelisted software.
James Forshaw, security researcher with Google's Project Zero
says the bug is one of several unfixed flaws in Microsoft's .NET software framework that allows Device Guard to be bypassed.
"There's at least two known DG bypasses in the .NET framework that are not fixed, and are still usable even on Windows 10S."
This latest bug in the .NET framework allows an attacker to run arbitrary code on a system supposed to be protected by Device Guard whitelisting, provided the attacker is first able to update the Windows registry.
