Window’s AppLocker allows remote execution of blacklisted files

The only current alternative is to block Regsvr32 with a firewall.

 

Since years, business focused Microsoft has taken the pains to have an AppLocker feature in its popular operating system which essentially allows you to create a list of blacklisted apps.

Although the feature has gone down well with network administrators who have used it to keep malware or risky software at bay, however a recent discovery by Casey Smith, a security researcher, has unnerved many administrators since its allows apps to bypass this barrier.

As Smith discovered, if you were to tell Regsvr32 to point to a remotely hosted app, even if that particular app was blacklisted by you, the system will still allow it to be run.

Naturally this could be quite useful to blackhat hackers and script kiddies. To make matters worse, the process is rather stealthy as it does not require administrator access or changes in the registry.

Microsoft has yet to patch this vulnerability and when asked to comment on this development, Redmond promptly replied that it will respond once it has something to say.

As a stopgap measure, all you can do now, as per Eric Rand, is to tell Windows Firewall to block Regsvr32, which should stop it from accessing files online. Although that may not be suitable or convenient to all, it nonetheless beats any present alternative.

Leave a comment