Microsoft’s AppLocker Oopsie: Uninvited Guests in Your DLL Party!
Microsoft’s “Defense in Depth” strategy hits a new high—or low—by planting a backdoor in AppLocker, allowing execution of DLLs that are supposedly blocked. Just add explicit deny rules to keep your system safe and your sanity intact!
Hot Take:
Microsoft might as well start a gardening club with all the backdoors they’re planting! It seems like their defense strategy is “hide in plain sight” because why else would they make it so easy to exploit their security loopholes? If you’re a security-conscious admin, it’s time to break out the digital shears and start trimming these vulnerabilities before they grow out of control!
Key Points:
- Microsoft Edge and Windows WebView are installing unprotected DLLs in user profiles.
- The DLLs, domain_actions.dll and well_known_domains.dll, are vulnerable to tampering.
- Security practices recommend blocking execution of DLLs in user-writable locations.
- AppLocker was updated to allow these DLLs, essentially creating a backdoor.
- Admins should add explicit deny rules to AppLocker to block these DLLs.
Already a member? Log in here