Modified a byte in sig - (No SmartScreen check) Signed calcxp.exe - (Checked w/ SmartScreen) We have a VM without internet connectivity, so we'll see a SmartScreen warning when we know it's being checked. To do this, Dormann says that a signed executable can be modified using a hex editor to change some of the bytes in the signature portion of the file and thus corrupt the signature.Ĭan we do the same trick with a signed EXE file? However, Microsoft told BleepingComputer that they are aware of the reported issue and are investigating it.Īfter the publication of this article, Dormann told BleepingComputer that threat actors could modify any Authenticode-signed file, including executables (.EXE), to bypass the MoTW security warnings.

The zero-day vulnerability is particularly concerning as we know threat actors are actively exploiting it in ransomware attacks.ĭormann shared the proof-of-concept with Microsoft, who said they could not reproduce the MoTW security warning bypass. 'On the other, baddies that take advantage of this bug can get a LESS-SECURE behavior from Windows compared to when the feature is disabled.' On one hand, it does scan for baddies that are downloaded.'

'So that whole setting is unfortunately currently a tradeoff. And disabling 'Check apps and files' reverts Windows to the legacy behavior, where MotW prompts are unrelated to Authenticode signatures,' Dormann told BleepingComputer. 'This issue is in the new-as-of-Win10 SmartScreen feature. jJbP9quvL6Īccording to Dormann, the bug stems from Windows 10's new 'Check apps and files' SmartScreen feature under Windows Security > App & Browser Control > Reputation-based protection settings. So I'll say it's fair to say that this bug was introduced with the release of Windows 10. However, for Windows 11, the bug would only trigger when running the JS file directly from an archive.ĭormann told BleepingComputer that he believes this bug was first introduced with the release of Windows 10, as a fully patched Windows 8.1 device displays the MoTW security warning as expected. Using this technique, threat actors can bypass the normal security warnings shown when opening downloaded JS files and automatically execute the script.īleepingComputer was able to reproduce the bug in Windows 10. Demonstration of the Windows zero-day bypassing security warnings

Javascript download for windows 8.1