Critical Windows security flaw: Windows SmartScreen bypass exploited since 2018

A critical security flaw in Microsoft’s Windows SmartScreen and Smart App Control has been exploited since 2018, potentially exposing millions of users to malware threats. This vulnerability, which affects both Windows 10 and Windows 11 systems, allows attackers to bypass crucial security measures designed to protect users from malicious files.

As noted in the report by BleepingComputer, security researcher Will Dormann recently brought attention to this long-standing issue, demonstrating how easily the “mark-of-the-web” (MOTW) security feature can be circumvented. MOTW is a crucial component that flags files downloaded from the internet, prompting additional security checks through SmartScreen.

Microsoft’s Windows SmartScreen and Smart App Control vulnerability

Dormann’s findings reveal that by using a specific technique involving the ISO disk image format, attackers can distribute malicious files that completely bypass SmartScreen warnings. This vulnerability extends to Windows 11’s Smart App Control feature, which relies on the same underlying technology.

The bypass technique exploits a flaw in how Windows handles ISO files. When a user downloads an ISO file, Windows doesn’t apply the MOTW flag to its contents. As a result, when the ISO is mounted and its contents are accessed, SmartScreen fails to recognize these files as potentially dangerous, even if they contain malware.

This vulnerability is particularly concerning because ISO files are commonly used for legitimate purposes, such as distributing software or system images. Malicious actors can exploit this trust to deliver harmful payloads without triggering security warnings.

Implications and risks

The implications of this vulnerability are significant, as it has potentially been exploited by malicious actors for years. Security experts are urging Microsoft to prioritize this fix, given the critical nature of SmartScreen in Windows’ defense against malware.

The risk extends beyond individual users to encompass businesses and organizations that rely on Windows systems. Attackers could potentially use this technique to bypass corporate security measures, potentially leading to data breaches, ransomware attacks, or other forms of cybercrime.

Protective measures for users

As we await Microsoft’s official patch, users should remain vigilant and rely on additional security measures. Here are some recommendations:

1. Exercise extreme caution when downloading and opening files from the internet, especially those in ISO format.
2. Ensure your antivirus software is up-to-date and perform regular system scans.
3. Be wary of unsolicited emails or messages containing file attachments or download links.
4. Consider using alternative file formats when possible, avoiding ISO files from untrusted sources.
5. Enable all available security features in Windows, including Windows Defender and regular system updates.

Broader context

This incident serves as a reminder of the ongoing challenges in cybersecurity and the importance of regular security updates and patches for operating systems and applications. It also highlights the need for a multi-layered approach to security, where users and organizations don’t rely solely on built-in OS protections.

The discovery of this long-standing vulnerability also raises questions about the effectiveness of security audits and the potential for other undiscovered flaws in widely-used software. It underscores the vital role that independent security researchers play in identifying and reporting such vulnerabilities.

As the digital landscape continues to evolve, with cyber threats becoming increasingly sophisticated, the importance of robust, adaptive security measures cannot be overstated. Users, organizations, and software developers must remain vigilant and proactive in addressing potential security risks.