Windows 10 Store 'wsreset' tool lets attackers bypass antivirus

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/windows-10-store-wsreset-tool-lets-attackers-bypass-antivirus/

A technique that exploits Windows 10 Microsoft Store called 'wsreset.exe' can delete bypass antivirus protection on a host without being detected.

Wsreset.exe is a legitimate troubleshooting tool that lets users diagnose problems with the Windows Store and reset its cache.

Pentester and researcher Daniel Gebert has discovered that wsreset.exe can be abused to delete arbitrary files.

As wsreset.exe runs with elevated privileges because it deals with Windows settings, this bug would allow attackers to delete files even if they would not normally have the privileges.

The researcher demonstrated how this behavior could be abused to bypass antivirus protections, focusing on Adaware antivirus as an example. [...]

 

[ForgottenSeer 85179]

Sounds like another case why UAC should be always on maximum.
And of course SRP

 

[SeriousHoax]

Sounds like another case why UAC should be always on maximum.
And of course SRP

Looks like this can bypass UAC at maximum.

As wsreset.exe runs with elevated privileges because it deals with Windows settings, this bug would allow attackers to delete files even if they would not normally have the privileges.

 

[Andy Ful]

This technique depends on the autoelevate feature of WSReset.exe. Any such bypass is blocked by UAC “Always Notify” setting. I confirmed it on my computer by using PowerShell POC:

Fileless UAC Bypass in Windows Store Binary

** Update ** - 9/13/2019 Metasploit has added a module for the UAC Bypass in Windows! Most of Metasploit modules are built by community contributors for free (i. e. modules that are worth the effort...

www.activecyber.us

 

[bayasdev]

I wonder who uses Adaware when BitDefender has its own Free AV which is way more advanced than a signature only approach

 

[TairikuOkami]

I wonder who uses Adaware when BitDefender has its own Free AV which is way more advanced than a signature only approach

Adaware is a little more customizable and it has no ADs.

 

[show-Zi]

Microsoft Store should distribute 'Anti wsreset tool'

 

[bayasdev]

Microsoft Store should distribute 'Anti wsreset tool'

Improving their store so we won't longer need wsret