Google: Microsoft’s Windows Security Could Be Hacked With One Unopened Email – Forbes

Windows 10 was carrying a nasty bug that allowed for remote hacks via a single email (Photo by Drew Angerer/Getty Images)

As bad flaws go, this one was particularly nasty. Google found a flaw in a security tool used in all modern Windows systems, known as the Microsoft Malware Protection Engine, that allowed total remote control over a vulnerable PC by just sending an email. It didn’t even need opening, just for it to be sent to the Windows machine was enough for the hack to work, Google Project Zero researchers Natalie Silvanovich and Tavis Ormandy reported today.

Ormandy had already described the bug as “crazy bad” and “the worst [of its kind] in recent memory.” In a full technical description of the bug, he wrote: “Vulnerabilities in MsMpEng [Microsoft Malware Protection Engine] are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service.”

Fortunately, Microsoft has rushed out a patch and all PCs running the vulnerable tool should receive an update today. “If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned,” the company wrote in its advisory. “If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.

“The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.”

Microsoft said the update should download automatically and users need not download anything. They can check they received the patch by following the instructions in the company’s advisory.

What’s the bug?

The issue lay in NScript – a component of Microsoft Malware Protection Engine that analyzes filesystems and network activity that looks like JavaScript. In parsing code, NScript didn’t properly validate what information it was running, in what’s known as a “type confusion” bug. An attacker was therefore able to hide malicious code in anything scanned by software, such as an incoming email or files served by a website. The vulnerability could be exploited on unpatched Windows 8, 8.1, 10 and Windows Server systems.

Ormandy noted that “there is no practical way to identify an exploit at the network level, and administrators should patch as soon as is practically possible.”

“It looks fairly severe,” added co-founder of Hacker House Matthew Hickey. “The [proof-of-concept hack] demonstrates remote code execution capability in various scenarios: you could exploit a system by uploading a file to [a] web server or sending an email to a Microsoft desktop. The malware protection service is enabled by default in Windows 8 and up. It’s a very critical bug.

“It seems this malware protection service might be an Achilles heel in Microsoft security model and system owners should consider disabling it.”

Despite the severity, Microsoft is receiving praise for how quickly it dealt with the bug, proving the value of the disclosure process…

Got a tip? Email at or for PGP mail. Get me on Signal on +447837496820 or use SecureDrop to tip anyone at Forbes.


Write a Reply or Comment:

Your email address will not be published.*