Microsoft Defender lets hackers know where to install malware

Forget what we said before…. Hackers exploit a vulnerability that affects the Microsoft Defender application in Windows to learn sites that are not scanned to install malware there.

The vulnerability has been around for at least eight years, according to some users, and affects Windows 10 from version 21H1 to 21H2.Windows Defender

Like any security application, Microsoft Defender allows users to add sites (local or networked) to their systems that they want to exclude from malware scans.

So there are many who add exceptions to antivirus that make it easier for other applications that are incorrectly detected as malware.

Of course the list of scan exceptions varies from user to user. This information is very useful for an attacker as he knows where the malware can be stored to avoid detection.

So security researchers have discovered that the list of sites excluded from Microsoft Defender scanning is not protected and can be accessed by any local user.

Local users can ask the registry questions and learn the paths that Microsoft Defender is not allowed to check for malware or dangerous files, and they do not even need administrator privileges.windef

Antonio Cocomazzi, a security researcher at SentinelOne, reports on the Bleepingcomputer. that there is no protection for this information, which should be considered sensitive, and that executing the "reg query" command reveals all instructions received by Microsoft Defender to scan files, folders, extensions, or processes.

Another researcher, Nathan McNulty, confirmed that the problem exists in versions 21H1 and 21H2 of Windows 10, but does not affect Windows 11.

McNulty also confirmed that one can obtain the list of exceptions from the registry with entries that store political group settings. This information is very sensitive as it provides exceptions for many computers.

Registration in via Email

Enter your email to subscribe to the email notification service for new posts.

Read them Technology News from all over the world, with the validity of

Follow us on Google News at Google news