🚨 Security Alert: Microsoft Patches 0-day Vulnerability in Windows (CVE-2024-38112) 🚨
This week, Microsoft patched a critical 0-day vulnerability in Windows, identified as CVE-2024-38112, which had been actively exploited by hackers for the past 18 months. Discovered by Check Point Research expert Haifei Li, this vulnerability allowed malicious scripts to bypass built-in security measures and was used to deploy malware. 🔒🛡
The vulnerability involves platform spoofing in Windows MSHTML. Hackers exploited this flaw by distributing Windows Internet Shortcut (.url) files, spoofing legitimate files (e.g., PDFs) to download and execute HTA files that install malware, such as the Atlantida Stealer, which steals passwords and other sensitive data. 📄➡️💻
How the Attack Works:
- Internet Shortcut Files: These simple text files, when saved with a .url extension, open specified URLs in the default browser.
- Exploiting mhtml: Attackers found that using the mhtml: protocol forces the URL to open in Internet Explorer (IE), even though IE is no longer the default browser in Windows 10 and 11. 🌐
- Less Warnings in IE: Opening URLs with mhtml: in IE shows fewer security warnings, allowing attackers to trick users into downloading and running malicious HTA files disguised as PDFs. ⚠️📑
Details from Experts:
- Will Dormann: Highlighted that opening URLs in IE provides hackers additional advantages due to fewer security warnings, leveraging the fact that IE is still present in Windows by default.
- Check Point Findings: Hackers create Internet Shortcut files with icons mimicking PDFs. When clicked, these open in IE and download a supposed PDF, which is actually a hidden HTA file. If the user opens the HTA file, it triggers the installation of malware. 🔍👨💻
Impact of the Malware:
- Atlantida Stealer: Once executed, this malware steals all credentials stored in the browser, cookies, browsing history, cryptocurrency wallet data, Steam credentials, and more. 🔑💰🕵️♂️
Microsoft's Patch:
- With the patch, using the mhtml: protocol no longer opens IE. Instead, Microsoft Edge is launched, which mitigates the exploit. 🛠✨
Stay vigilant and ensure your systems are updated to protect against this critical vulnerability. Always be cautious with unexpected files and links to maintain your security. 🔄🔐
Stay tuned and stay secure! 🌐🔒
#SecurityAlert #MicrosoftPatch #CVE202438112 #CyberSecurity #WindowsVulnerability #CheckPointResearch
