Microsoft patches remote code execution flaw in Windows Defender

The article doesn't say when backdoor had been discovered, by whom and how long it took it to patch.

The longer time indicate MS intent to replace it with a different backdoor.

The method how Microsoft fix these 'bugs' is not acceptable. The (so called) "virus definition file" is actually an active executable code running in NT System Authority. It is very unsafe, as every new "virus definition file" can activate new backdoors. Starting from v.1709 MS 'telemetry' spying and crypto-currency engine is being integrated with Defender, so now you may have better understanding a real purpose of the "virus definition file".
 
sajunky said:
The article doesn't say when backdoor had been discovered, by whom and how long it took it to patch.

The longer time indicate MS intent to replace it with a different backdoor.

The method how Microsoft fix these 'bugs' is not acceptable. The (so called) "virus definition file" is actually an active executable code running in NT System Authority. It is very unsafe, as every new "virus definition file" can activate new backdoors. Starting from v.1709 MS 'telemetry' spying and crypto-currency engine is being integrated with Defender, so now you may have better understanding a real purpose of the "virus definition file".
Click to expand...

What?
 
sajunky said:
The article doesn't say when backdoor had been discovered, by whom and how long it took it to patch.

The longer time indicate MS intent to replace it with a different backdoor.

The method how Microsoft fix these 'bugs' is not acceptable. The (so called) "virus definition file" is actually an active executable code running in NT System Authority. It is very unsafe, as every new "virus definition file" can activate new backdoors. Starting from v.1709 MS 'telemetry' spying and crypto-currency engine is being integrated with Defender, so now you may have better understanding a real purpose of the "virus definition file".
Click to expand...

Can you provide proof of anything you say here?
Just asking, would be nice to know if these are facts or just your opinion.
 
sajunky said:
The article doesn't say when backdoor had been discovered, by whom and how long it took it to patch.

The longer time indicate MS intent to replace it with a different backdoor.

The method how Microsoft fix these 'bugs' is not acceptable. The (so called) "virus definition file" is actually an active executable code running in NT System Authority. It is very unsafe, as every new "virus definition file" can activate new backdoors. Starting from v.1709 MS 'telemetry' spying and crypto-currency engine is being integrated with Defender, so now you may have better understanding a real purpose of the "virus definition file".
Click to expand...

Lol.
 
Since the staff writer didn't get this info, here you go:

It's called CVE-2018-0986. You can find its entry into the database here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0986

It was discovered by Google Project Zero's Thomas Dullien. Here's his Twitter: https://twitter.com/halvarflake

And here's a full breakdown of how and why it works: https://bugs.chromium.org/p/project-zero/issues/detail?id=1543&desc=2

sajunky said:
The longer time indicate MS intent to replace it with a different backdoor.
Click to expand...

You don't seem to understand the underlying technology here, or how this exploit could have worked in the first place.

sajunky said:
The (so called) "virus definition file" is actually an active executable code running in NT System Authority. It is very unsafe, as every new "virus definition file" can activate new backdoors.
Click to expand...

You need to:

A) Prove that the virus definition file is running as executable code as the NT System Authority user
B) Substantiate your claim that the virus definition file can activate new backdoors
C) Look up what an interpreter does and how it fits into the MSE in Windows Security Essentials/Defender/Advanced Threatguard.
D) Maybe read this: https://www.virusbulletin.com/virus...ositive-disaster-anti-virus-vs-winrar-amp-co/
 
Last edited:
sajunky said:
The statement you made in a quoted part.
Click to expand...


Cause it says so!?

https://www.bleepingcomputer.com/ne...pdate-patches-malware-protection-engine-flaw/

Yesterday, April 3, Microsoft released an emergency security update via Windows Update that fixes CVE-2018-0986, a vulnerability in the Microsoft Malware Protection Engine (MMPE).

MMPE (mpengine.dll) is the malware scanning, detection, and cleaning component of several Microsoft antivirus and antispyware programs, such as Windows Defender, Microsoft Security Essentials, Microsoft Endpoint Protection, Windows Intune Endpoint Protection, and Microsoft Forefront Endpoint Protection.

Vulnerability rated "critical"
A Google security researcher discovered a flaw in the MMPE component that allows attackers to execute malicious code on a Windows machine. Because the MMPE component runs with system privileges, the bug, if exploited, can grant attackers complete control over a victim's system.

Microsoft rated the vulnerability as "critical," its highest severity level. "To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine," the company said in an advisory.
Click to expand...
 
May I propose that we implement a system that bans sajunky from any threads that have the word Microsoft or Windows in it?
 
sajunky said:
The statement you made in a quoted part.
Click to expand...

Feel free to elaborate on that statement, please. Because apart from giving you the CVE number, I didn't really state anything else. Except for that one part where I said you didn't understand how the exploit worked in the first place. That was definitely stated.

Oh, and I'm still waiting for you to:

A) Prove that the virus definition file is running as executable code as the NT System Authority user
B) Substantiate your claim that the virus definition file can activate new backdoors
C) Look up what an interpreter does and how it fits into the MSE in Windows Security Essentials/Defender/Advanced Threatguard.
D) Maybe read this: https://www.virusbulletin.com/virusb...winrar-amp-co/
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X