Skip to main content

Oops: Microsoft’s “Super-secure” Windows 10 S Hacked In 3 Hours


windows 10 s hacked
Image: ZDNet
With the launch of Windows 10 S, Microsoft claimed that it’s an extra-secure operating system that’s protected against all kinds of ransomware. To test the claims, folks at ZDNet hired a security firm. As a result, the hackers were able to breach Windows 10 S within 3
hours by using Microsoft Word’s handling of macros.
At its Build 2017 Developer Conference, Microsoft unveiled a new version of Windows 10, which was called Windows 10 S (here’s how it’s different from Windows 10). Aimed primarily at schools and education sector, this operating system doesn’t allow one to install applications other than those from Windows Store. Microsoft said that it was an additional step taken to enhance the security.
While this inability to install foreign applications on Windows 10 S was bashed by many, Microsoft further declared that Windows 10 S can’t be targetted by any kind of ransomware. That’s a bold claim.
So, to check the validity of this claim, the folks at ZDNet hired the security firm Hacker House. They put a simple question in front of Matthew Hickey, a security researcher and co-founder of Hacker House: “Will ransomware install on this operating system?”

Macros tricked Microsoft once again

Windows 10 S did present some hurdles. Apart from the only-Windows-Store-apps limitation, there isn’t any Command Prompt or PowerShell. The hacker expected more restrictions on trying to run processes with escalated privileges, but he was surprised to realize how easy it was to hack Windows 10 S.
He made use of a longtime foe — macros. Hickey was able to exploit how Word handles and processes macros. He created a notorious, macro-based Word file. Upon opening, the file allowed him to launch a reflective DLL injection attack. This way he bypassed the Windows Store restriction put by Microsoft because Word is itself available in Windows Store.
macros windows 10 s hack
Image: ZDNet
Please note that Word’s protected view feature blocks the macros in files which are downloaded from the internet or email. That’s why Hickey downloaded the file via a network share. Windows considers it a trusted source and gives full access.
By running the code, he was able to download a payload using Metasploit (here are some more hacking tools) and connect the OS to his C&C server. This way, he was able to remotely control the computer. “If I wanted to install ransomware, that could be loaded on,” he said. “It’s game over.”
You can read the complete story on Windows 10 S hack here on ZDNet.

Comments

WHAT'S HOT

Fappening 2.0 Continues: Modern Family Actress Sarah Hyland Has Become The Latest Victim Of Notorious Hackers [Private Photos, Video Leaked]

Modern Family actress Sarah Hyland has become the latest victim of notorious hackers. Her private pictures and video have been posted online on infamous website Celeb Jihad. According to media sources, Sarah’s lawyers are planning to take legal action against the websites who choose to publish the leaked material. Meanwhile, the actual powers behind the leak are unknown.

Samsung Overtakes Fitbit In Wearable Sales For First Time

Fitbit has been a top competitor on the global wearable market for a long time, but the South Korea giant Samsung managed to steal the silver crown of the wearable market from Fitbit. According to Strategy Analytics, Samsung gained the

Supermassive Black Holes Found Orbiting Each Other For The First Time

Image Credit: UCR Researchers from Stanford University have identified super-massive binary black holes at the center of Galaxy 0402+379 about 750 billion light years away. The two of the black holes are just 24 light years apart and one of them is orbiting the other. This is the first

Owners Of The Samsung Gear S3 In The United Kingdom Have Finally Received A Software Update That Enables Support For Samsung Pay

Owners of the Samsung Gear S3 in the United Kingdom have finally received a software update that enables support for Samsung Pay. Starting today, users will be able to use the Gear S3 smartwatch to make payments on all contactless