Security News Windows Defender Antivirus Still Vulnerable to Attacks Despite Patches

[Exterminator]

Microsoft rolled out several patches for Windows Defender in order to address vulnerabilities that could have exposed Windows users, but it turns out that the company needs to do better because the antivirus is still suffering from a number of remote code execution flaws.

A report from The Reg and citing security research James Lee reveals that the MsMpEng engine of Windows Defender is open to remote code execution due to insufficient sandboxing, a problem that some other security experts warned of in the last few months.

Google’s Tavis Ormandy, who previously discovered several major bugs in Microsoft software, also came across critical bugs in Windows Defender, and reported them to the company to have them fixed.

After patches for all these reported vulnerabilities were provided, Ormandy tweeted on June 7 to reveal that he found “more critical remote mpengine vulnerabilities,” explaining that the antivirus engine needs to be sandboxed.

Microsoft needs to focus more on sandboxing
The same problem is highlighted in today’s report as well, as James Lee has discovered two remote code execution vulnerabilities that allow a system to get hacked despite running the very latest patches released by Microsoft.

It appears that the new issues aren’t related to the ones reported by Ormandy earlier this month and in late May, describing them as “multiple denial-of-service, integer overflow, and use-after-free bugs.”

An official statement from Microsoft is not available just yet, and it’s a bit worrying that reports of vulnerabilities in Windows Defender come only a few days after this month’s Patch Tuesday when the company typically addresses security vulnerabilities in its software.

For the time being, however, details of the new RCE flaws are not public, so users are protected, though Microsoft should hurry up to deliver a fix addressing all of them. Ormandy also promised to provide a full report on the flaws he discovered in MsMpEng, so Microsoft might have a lot of work to do in order to get its antivirus engine right.

 

[_CyberGhosT_]

Microsoft rolled out several patches for Windows Defender in order to address vulnerabilities that could have exposed Windows users, but it turns out that the company needs to do better because the antivirus is still suffering from a number of remote code execution flaws.

A report from The Reg and citing security research James Lee reveals that the MsMpEng engine of Windows Defender is open to remote code execution due to insufficient sandboxing, a problem that some other security experts warned of in the last few months.

Google’s Tavis Ormandy, who previously discovered several major bugs in Microsoft software, also came across critical bugs in Windows Defender, and reported them to the company to have them fixed.

Thanks Exterminator
MS is making strides in the right direction, but it will be a year or two before I wake Defender from it's slumber.

 

[Arrabida Rock]

Really, i know that since 2010 when i got my first pc! Even it changed the name!

 

[Malware Person]

this is problematic for me. switching my antivirus

 

[_CyberGhosT_]

this is problematic for me. switching my antivirus

May be a smart move

 

[Winter Soldier]

This is a long road, but new patches will come for sure.

Do you remember for example how to perform API hooking at kernel level on 32bit Windows systems to prevent a antimalware process from being terminated?
Now we can talk about OBR and callbacks mainly to show how to achieve the same result on 64bit systems.
AVs have to protect themself from malware trying to terminate their services and processes or inject arbitrary code into their executable address space.
Well no matter how hard you try, there’s really no 100% safe way to do this in user mode … you could try API hooking, passive monitoring.... but there is always a way to bypass a user mode protection. API hooks can be overwritten, monitoring can be eluded with obfuscation.

Working in the Windows kernel means developing a driver, that’s why Microsoft implemented a set of new API to intercept and eventually filter events and actions on object handles before they are actually executed by the kernel.

Technically it is very complex stuff, but very, very simply, a callback prevents some processes from being accessed with some privileges, so any malicious software that will try to terminate it or to call API such as (Write/Read)ProcessMemory will inevitably fail with "access denied" error!

So this is how AV and security softwares are being protected nowdays on 64bit systems from malicious termination, code injection, etc.

Is this enough!? No, but a lot of progress has been made and another will be made for sure.

 

[Malware Person]

May be a smart move

bought and using bitdefender total security now

 

[jamescv7]

Microsoft can surely derive those sandbox mechanism from IE and Edge which will make Windows Defender strong enough for possible security holes.

 

[Urusen]

Defender was my easy choice. Time to pick another AV solution again...

 

[Windows Defender Shill]

Not worried

It's not in the wild

And my settings dont let non windows store apps install.

My completely uninformed guess on how this works:

This is probably executed with smart screen off and allow apps from anywhere turned on.

At which point Defender scans malicous file and it triggers Defender to run the file instead of ignoring or removing.

 

[Exterminator]

Microsoft Patches Another Windows Defender Bug

Microsoft Patches Another Windows Defender Bug

 

[ispx]

but it will be a year or two before I wake Defender from it's slumber.

two years from now the other anti-virus vendors will still be 2 years ahead of windows defender.

windows defender is like the crappy audio system you got free with your new car that you trash & replace with a pioneer or a sony.

 

[enaph]

Take it easy boys - WD is not the only AV with security flaws.

 

[ispx]

Take it easy boys - WD is not the only AV with security flaws.

true & i totally agree with you, nobody & nothing is 100% perfect.

but the boys at microsoft seem to be living in their own parallel universe :

Microsoft Responds to Kaspersky, Says Windows Defender Is a Top Antivirus