App Control Made Smarter

 How I wish I can decide if the apps that I am executing are safe, malicious, or from an untrusted source? Well, Microsoft has heard mine, I guess. They have come up with a feature called the “Smart App Control” which does just that. However, this feature is available only on clean installations of the Windows 11 22H2 update. That said, let us hope they will roll out for other versions of Windows that have active support.  

Want to know more? Read on.

What is a Signed App?

The developers do app signing to identify the app author. This helps the developers to update their app without any need for complicated permissions. Read more in this blog post.

Can malicious or untrusted apps be signed?

Hope this is not true. But the fact is yes. Threat actors can use stolen signatures or create a legitimate signature for their malicious app. This would then bypass any signature validations. Read more in this blog post.

What is Smart App Control (SAC)?

SAC is a security feature from Microsoft that is designed to block malicious, unsigned, or untrusted apps from executing on your computer. Apart from this, it also blocks potentially unwanted applications (PUA) from executing, which could slow down your computer’s performance, threaten the system’s security, or do things that are not expected.

If it is not able to make a decision, then the app is allowed to execute only if it has a valid signature. The app is stopped from executing if it has an invalid or no signature.

Can threat actors bypass SAC validations?

As of date, this is considered foolproof. The Smart App feature offers significant protection from new threats, and when this is used alongside Microsoft or third-party AntiVirus, you get to enjoy a very safe experience.

However, that said, there is still a hitch. SAC will approve an app if it has a valid signature. So, if threat actors use either stolen signatures or create one that is legitimate or if it is a digitally valid signed PUA, SAC may approve it based on the certificate’s legitimacy or if the signature can bypass its trusted AI model. How Microsoft will handle this, one needs to wait and see. 

Overall, this is a good feature from Microsoft for Windows 11 users to enjoy a safe digital experience. This feature can be disabled, albeit at your own risk, and to re-enable it, as of now, one has to do a clean install of Windows 11.

Comments

Post a Comment

Popular posts from this blog

AMOS (MacOS Stealer)

  In the last week of April 2023, it was reported on twitter , that through a telegram channel a new malware was being offered as “Atomic MacOS Stealer”. Many samples of this malware were found on the internet. Figure 1 – Atomic MacOS Stealer Most of these samples were masquerading as an installer of various applications like Tor browser, Photoshop CC, Notion, FL studio. Figure 2 – Amos DMGfiles masquerading as different applications These are delivered as a DMGfile(Disk Image) which is the common format for software distribution & installation packages on macOS. We identified the Tor browser DMG file for the analysis. When we execute the DMG file it gets mounted and we can see the resulting window advises the user to execute the application by right clicking. Figure 3 – Tor Browser These fake applications are created by using Appify , which is used to create applications just by having the executable alone. The icons can be customised. That’s why these applications are in dif...
Read more

Ransomed by Warlock Dark Army “OFFICIALS”

  Recently we came across a tweet shared by petikvx . The tweet was on a ransomware family that had the group name similar to the WARLOCK DARK ARMY. The similarities with Chaos ransomware seem to end with the attacker group’s name. Upon analyzing the ransomware from the tweet we suspect both to be very different groups just based on their malware’s attributes. The sample under consideration was compiled using C/C++, in case of Chaos ransomware it is usually .Net. Statically looking at the file we noticed a resource entry under Bitmap with an identifier “14”, while analyzing the file code we noticed that this resource was read and loaded on to the memory. Hence we decided to dump that resource entry. Figure 1: Encrypted blob in resource section Figure 2 : Loading blob into the memory During our code analysis we found this blob was XOR encrypted. The first 16 bytes of this blob acts as the key for XOR decryption and the rest is the data which plays a key role in this ransomware’s in...
Read more

MuddyWater Back with DarkBit

  Recently, we came across a tweet about DarkBit ransomware. An Iranian APT group, named MuddyWater, is reportedly behind the DarkBit ransomware. In this blog we will explore the ransomware’s initial access method, the use of Cobalt Strike and the final ransomware payload. Initial Access Method The initial lure was delivered as an ISO file. Figure 1 – ISOFile The payload included a shortcut file (with a .doc extension) and a zip file. Figure 2 – Contents Inside ISO File The shortcut was using PrintBrm.exe to unpack the HR-Update.zip and run it as shown below. PrintBrm.exe is a windows inbuilt command line tool . Figure 3 – Shortcut File cmd.exe /c xcopy .\HR-Update.zip %TEMP% /h /y && PrintBrm.exe -r -f %TEMP%\HR-Update.zip -d %TEMP%\unzip & %TEMP%\unzip\HR-Update.exe Figure 4 – HR-Update.exe Running HR-Update.exe was a Cobalt Strike beacon. Cobalt Strike, a penetration testing tool, can also be used by attackers for gaining a foothold in the system. The final ran...
Read more