[CVE-2024-38213]: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

In today’s ever-evolving digital landscape, securing operating systems against a growing array of threats remains a critical challenge. Microsoft Windows, one of the most widely used operating systems, includes several built-in security features to help protect users from malicious attacks. Among these, SmartScreen is a key defense mechanism designed to safeguard users from phishing, malware, and other potentially harmful applications. It works by evaluating files and URLs against a dynamic, cloud-based reputation service.

However, a recently discovered vulnerability CVE-2024-38213 has exposed a weakness in SmartScreen, enabling attackers to bypass this important security feature. This could potentially leave users vulnerable to a range of malicious activities. In this blog, we’ll delve into the specifics of this vulnerability, explore its potential impact, explain how it works, and provide recommendations for mitigating the risk.

What is SmartScreen?

• Alert users about files or websites with a known malicious reputation.

• Prevent the execution of dangerous files by assessing them against Microsoft's cloud-based reputation database.

• Identify and block potentially unwanted applications (PUAs) and harmful websites, helping to prevent users from unintentionally accessing malicious content.

File Details:

Hash    : 1d3ff54b0c9dcdd0ed770831b7570fe44c932648c57d686e68583a8582fca97f
Filename: FEDEX234598765.html
FileType: HTML HyperText Markup Language (100%)
Size    : 347.00 KB (355328 bytes)

Vulnerability Type: Security Feature BypassCVE 
ID: CVE-2024-38213
Affected Product: Microsoft Windows (specific versions not mentioned in the CVE entry)
Vulnerability Score: V3.0: 6.5 Medium

Impact: This vulnerability enables an attacker to bypass the SmartScreen feature, which is intended to warn users about potentially malicious files or websites. 
SmartScreen is a key security measure in Windows that helps prevent the execution of known malicious software and protects against phishing attacks

Infection Chain:

Attack Overview:

When a user opens an attached .html file, it may contain embedded scripts or functions that are triggered automatically. These scripts can include malicious JavaScript or other types of code, designed to execute as soon as the file is opened in the user's web browser. One of the primary risks is that these embedded functions can redirect the user's browser to a harmful or malicious URL.

Once the .html file is opened, the embedded code is executed automatically, often without any direct user interaction. This can happen in the background or may cause a new browser tab or window to open, depending on how the code is written. The malicious URL that is triggered by this process can be used for various malicious purposes, including:

• Phishing Attacks: The malicious URL could lead the user to a fraudulent website designed to impersonate a legitimate service. This can trick the user into entering sensitive information such as login credentials, credit card details, or personal data.

• Malware Installation: The malicious URL may prompt the browser to download and execute harmful files, such as viruses, ransomware, or spyware, which can compromise the user’s system or steal data.

• Exploiting Vulnerabilities: The malicious site could attempt to exploit vulnerabilities in the user's browser or plugins, enabling the attacker to take control of the machine or access private information without the user’s knowledge.

Attachment File:

HTML Script:

An HTML script is a block of code, typically written in JavaScript, embedded within an HTML document. It enables interactive features, controls page behavior, and manipulates content on a webpage. Scripts are included using the <script> tag in HTML.

Once the .html file is opened, the embedded code is executed automatically, often without any direct user interaction. Here's the landing page of the Phishing URL.

Indicator of Compromise (IOC):

Analyzing sandbox results allows us to identify whether a URL is linked to malware, phishing, or other malicious activities. In this case, the analyzed URL has been confirmed as 100% malware. 

MITRE ATT@CK MATRIX:

Tactics				          Techniques.

Initial Access	       - Phishing Attachment (.html).
Execution              - Native API.
		                 Exploitation for Client Execution.
                         Powershell.
Persistence	           - Scripting (.JS/.VBS).
                         Windows Service.
Privilege Escalation   - Process Injection.
                         Bypass User Account Control 
Defense Evasion	   	   - Process Injection.
                         Virtualization/Sandbox Evasion.
                         Disable or Modify Tools.
                         Masquarding.
Discovery		       - Virtualization and Sandbox Evasion Technique.
                         Security Software Discovery.
                		 Application Window Discovery.
                         File and Directory Discovery.
Collection             - Archive Data Collection.
                         Email Collection.
                         Clipboard Data.
Command & Control	   - Non-Application Layer Protocol.
			             Application Layer Protocol.
                         Ingress Tool Transfer

Happy Hunting!!