Microsoft’s AppLocker Backdoor Blunder: A Comedy of Errors in Cybersecurity
Microsoft planted a backdoor in AppLocker, allowing execution of DLLs like domain_actions.dll, bypassing security policies. To prevent this unwelcome guest, administrators should add explicit deny rules to their AppLocker configuration. Stay tuned and keep your distance from untrustworthy software!
Hot Take:
In a masterclass of unintentional irony, Microsoft seems to have given hackers a free pass with their latest “security enhancement.” Who knew a backdoor would be the hottest new feature of Windows 11? Move over, Clippy, there’s a new uninvited guest in town!
Key Points:
- Microsoft has included two DLLs, domain_actions.dll and well_known_domains.dll, in its Edge browser and WebView component.
- The DLLs are placed in user-writable locations, making them vulnerable to tampering.
- This move inadvertently bypasses security measures like AppLocker, which typically blocks such executions.
- The issue was identified in Microsoft’s release notes for Edge versions 135.0.3179.11 and 135.0.3179.54.
- Security experts recommend adding explicit deny rules in AppLocker to prevent exploitation.
Already a member? Log in here