A newly exposed flaw hides behind a familiar Windows security tool, while users face an uncomfortable question which programs they can trust.
As noted by Techcrunch
Security researcher Nightmare Eclipse has disclosed information a new Windows zero-day vulnerability called ShieldBreak. According to the researcher, the issue could give attackers full control of a device and access to user data.
The disclosure came several weeks after Microsoft said it might take legal action against specialists who reveal unknown vulnerabilities in its software outside the rules of responsible disclosure.
ShieldBreak is linked to a flaw in Windows Defender, the operating system’s built-in security tool. Nightmare Eclipse claims that the exploit enables privilege escalation, from a restricted user account to system-level access.
To demonstrate the issue, the researcher published a proof of concept in the form of a Windows application. To launch the attack, a user must open the program.
According to Nightmare Eclipse, the following systems may be vulnerable:
Security researcher Will Dormann confirmed that the exploit works. He clarified that Windows Defender must be enabled on the device for the vulnerability to be exploited.
The new attack method is based on Nightmare Eclipse’s earlier work, called RoguePlanet. Microsoft previously released an update intended to address that issue. However, the author of ShieldBreak said that RoguePlanet’s protections can be completely bypassed.
At the time ShieldBreak’s details were disclosed, Microsoft had not released a security update to fix the vulnerability. The company also did not provide an immediate to TechCrunch.
ShieldBreak is considered a zero-day vulnerability because its details became public before the developer had prepared a fix. This means users could potentially remain without official protection until Microsoft releases a patch.
Nightmare Eclipse has previously criticized Microsoft for what the researcher considers an inadequate response to bug reports. The researcher has also disclosed other Windows issues that were later used in attacks against organizations.
In May, Microsoft warned that it could take legal action against researchers who publish information zero-day vulnerabilities without complying with its responsible disclosure requirements.
After criticism from the community, the company softened its wording on social media. However, Microsoft’s original blog post remained unchanged.
Information ShieldBreak was disclosed the day after another Patch Tuesday, during which Microsoft released around 500 security fixes. Until an official patch for this zero-day vulnerability is available, Windows users should be cautious running unknown applications, as opening one may be the initial stage of an attack.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
