This week two different Windows vulnerabilities were revealed that attack your PC from different angles. However, there is one unfortunate thread that connects them; both are capable of allowing a malicious actor to gain system privileges on your Windows device, and neither has been patched yet.
The flaws are a zero-day vulnerability that can circumnavigate a previous RoguePlanet and a new "Plug and Pwn" attack that emulates USB devices.
Read on to find out what each attack can do and how to potentially stay safe until they get patched.
Shieldbreak Zero-Day
The zero-day vulnerability was found by Nightmare Eclipse, a bug hunter who reportedly has major beef with Microsoft and no qualms sharing the latest vulnerabilities they've discovered before a patch has released.
The latest, dubbed ShieldBreak, can apparently get around the RoguePlanet patch and allows attackers to gain system privileges on patched Windows 10, Windows 11 and Windows Server system.
Per The Register, the exploit has been tested by other security researchers and confirmed.
ShieldBreak apparently uses a "user-mode callback hook" to change file contents uring a Defender cloud-hydration scan via cfapi (Cloud Filter API)," according to security researcher Kevin Beaumont.
Basically, it uses Microsoft Defender, if enabled, when it runs a scan. Then the flaw can be exploited to give System privileges. Another researcher, Will Dormann, says that Defender has to be active for the exploit to work.
How to stay safe from Shieldbreak
Until Microsoft patches this vulnerability, one way to stay safe is to disable Microsoft Defender.
If you think your system might be vulnerable, Kevin Beaumont did publish three detections that are supposed to be able to catch Shieldbreak in action. If you have the knowledge, you could try running them.
Plug and Pwn
The other flaw is a new "plug and pwn" disclosed by security researchers Alejandro Hernando and Borja Martinez (via Bleeping Computer) during the recent DEF CON 34 hacking conference. This vulnerability exploits how Windows identifies and automatically connects USB hardware, finds matching driver packages and then installs software as the Authority/System account.
Simply, the flaw emulates USB devices and can be used to force Windows to install vendor packages with exploitable components that can be used to gian system priviliges on a Windows device.
Apparently, in some attacks there didn't even require user interaction or even physical USB hardware to gain access. This is enabled because Windows uses something called a co-installer, which automatically downloads and installs software and drivers when a new USB device is inserted in the computer.
This specific version is different from previous ones because it follows the Windows installation path and not something from a specific vendor. Notably, the remote attacks only seem to work on systems where USB redirection is enabled, which Alejandro Hernando said is common with virtual desktop environments.
Bleeping Computer gets far more granular if you're interested in how Hernando and Martinez discovered the flaw and the tools they used to instigate it.
How to stay safe from this USB attack
If you are concerned about this kind of attack and willing, you could enable a 'DisableCoInstallers' registry value. This prevents driver packages from utilizing co-installers during device installtion.
You can do this by searching for it in the Start menu or using the keyboard short cut of the Windows key +R. Then navigate to https://www.youtube.com/live/c84y9gAY90c Registry Key. Then add DWORD-32 value named DisableCoInstallers and set it to 1.
It doesn't totally eliminate plug and pwn attacks but it could break some of them.
"In anything sensitive I'd pair it with device installation restrictions or hardware-ID allow-lists, and turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)," Hernando told BleepingComputer.
It's a good reminder either way to make sure you're only plugging in trusted devices to your system or downloading software from official sources when you can to ensure the safety of what you're putting into your computer.
Follow Tom's Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds.
More from Tom's Guide
