[ad_1]
Microsoft has disabled the MSIX ms-appinstaller protocol handler exploited in malware assaults to put in malicious apps immediately from an internet site by way of a Home windows AppX Installer spoofing vulnerability.
As we speak’s choice comes after the corporate launched safety updates to deal with the flaw (tracked as CVE-2021-43890) throughout the December 2021 Patch Tuesday and supplied workarounds to disable the MSIX scheme with out deploying the patches.
The doubtless purpose for disabling the protocol altogether is to guard all Home windows clients, together with those that have not but put in the December safety updates or utilized the workarounds.
“We’re actively working to deal with this vulnerability. For now, we now have disabled the ms-appinstaller scheme (protocol). Which means App Installer won’t be able to put in an app immediately from an internet server. As a substitute, customers might want to first obtain the app to their gadget, after which set up the package deal with App Installer,” mentioned Microsoft Program Supervisor Dian Hartono.
“We acknowledge that this characteristic is vital for a lot of enterprise organizations. We’re taking the time to conduct thorough testing to make sure that re-enabling the protocol could be carried out in a safe method.
“We’re trying into introducing a Group Coverage that may enable IT directors to re-enable the protocol and management utilization of it inside their organizations.”
How menace actors abused ms-appinstaller to push malware
As BleepingComputer reported, Emotet began spreading and infecting Home windows 10 and Home windows 11 methods in early December utilizing malicious Home windows AppX Installer packages camouflaged as Adobe PDF software program.
Emotet’s phishing emails used stolen reply-chain emails and instructed potential victims to open PDFs associated to the earlier dialog.
Nevertheless, when clicked, hyperlinks embedded within the emails will redirect the recipients onto pages that, as an alternative of opening the PDF, would launch the Home windows App Installer program and ask to put in an “Adobe PDF Element.”
Whereas it seems like a reputable Adobe app, App Installer will obtain and set up a malicious appxbundle hosted on Microsoft Azure when the consumer clicks the Set up button.
You will discover extra data, together with the way in which Emotet abused the built-in Home windows App Installer characteristic throughout the marketing campaign, in our earlier report.
This AppX Installer spoofing vulnerability was additionally exploited to distribute the BazarLoader malware by way of malicious packages hosted on Microsoft Azure, utilizing *.internet.core.home windows.web URLs.
[ad_2]
