Researcher Warns Of DNS Vulnerability In Windows 10

The way Windows handles 10 with DNS requests causes the ISP or the provider of a Wi-Fi network can see what websites are being visited, although there is a VPN (Virtual Private Network) use. Before that warns a Russian researcher.

Windows 10 sends DNS requests to all available network interfaces. These requests are used for example in order to find the location of a web site. The functionality to send the requests to all interfaces are already present in Windows since Windows 8. According to the researcher using the alias "ValdikSS" Microsoft has probably done to accelerate the process, such as a DNS server is unreachable. In this case the answer of a second DNS server is used. However, this ensures that all leaks DNS requests via the network interface, allowing the ISP or provider of the Wi-Fi network can monitor all websites visited.

In the case of Windows 8, the feature that makes this be disabled via the Windows Registry. Even sent Windows 8 and 8.1 all DNS requests through the public interface, DNS spoofing would when using a VPN, however, are tricky. In DNS spoofing is the wrong response to the DNS request from the user data, so for example, will be redirected to a malicious website. In the case of Windows 8 and 8.1 would be the spoofed DNS request will be accepted only if the primary DNS server, which goes through an encrypted VPN connection does not answer.

Windows 10

Windows 10 has changed this, the researcher says. Not only does Windows 10 sends DNS requests to all interfaces, then using the fastest answer arrives. This allows the ISP or provider of the Wi-Fi network can DNS "very straightforward and trustworthy" hijack, warns the researcher. In addition, the option in Windows 10, which for this purpose ensures not to switch off via the Windows Registry. The only solution, according to the researcher is not completely reliable, is to set the DNS servers on the network interface.

Malwarebytes: Registry Cleaners Are Scams

On the Internet, numerous programs are offered to clean and optimize the Windows Registry, called registry cleaners, but this kind of software is actually meaningless, misleading users only. This enables anti-virus company Malwarebytes. On the forum of the virus fighter users regularly complain about registry cleaners. The programs are often distributed on dubious. Because of the increased complaints will Malwarebytes registry cleaners that are aggressively disseminate weather messages as unwanted software.

The Windows registry is basically a database of configuration settings and options for Windows. By installing and removing software may leave registry keys. Some users may think that the removal of these keys or the optimization of the Windows Registry can improve the performance of the computer. However, according Malwarebytes there is a placebo effect, because users see a nice animation and think that something is happening on their system.

The virus fighter designates registry cleaners also as the digital equivalent of " snake oil . " The performance improvements resulting from these types of programs are "at best, tiny and not noticeable," says Malwarebytes. At worst, it could damage the computer, however, so that a reinstallation of Windows. Even Microsoft does not recommend the use of registry cleaners.

However, the virus fighter will not all these programs consider undesirable. "We can tell you that these programs are scams, but we're not going to commit to not use them." However, the software will be considered undesirable as it presents itself to users and parasitic example through the installation of other software or other exhibits aggressive features.

Registry Malware Infecting Nearly 200,000 Computers

Malware that only in the Windows Registry is hiding in order to avoid detection and removal has in recent months nearly 200,000 infected computers. It is the Poweliks malware that infected computers used for click fraud and even a zero-day vulnerability in Windows applied to take over a computer completely.Once active Poweliks will first check whether Windows PowerShell is present.

This is a scripting language that allows system administrators to automate many tasks. It is present by default in Windows 7 and can also be installed on other versions of Windows. In case PowerShell is not present is downloaded and installed. Power Shell will later be used to conduct an encoded script file.

This script file contains malware, and makes it possible to download and install additional malware. Then, a key in the Windows Registry created so that the malware is also loaded at the next reboot of the system. By not using a file, like most malware does, but who are completely in the Windows Registry to hide would be more difficult to detect and remove Poweliks.

Ransomware

The malware aims to commit click fraud, where there are visited all kinds of pages that contain advertisements via a hidden browser window. The criminals are paid for every ad displayed. One problem for victims of Poweliks is that the ads displayed itself may be malicious. Poweliks infected with a computer can therefore become infected with a variety of other threats, including ransomware.

According to anti-virus company Symantec , a report ( pdf ) published on the malware, there are many cases in which there was downloaded ransomware through the ads displayed. Remarkably, the malware is active mainly in the United States. Of the 198,500 infected computers showed that 99.5% were in the US. However, that does not mean that users in other countries are not at risk. The virus fighter says that Poweliks shows what future threats may do, with cyber criminals are even more determined to make money from their creations.

Researcher Bypasses Windows UAC New Trick

Windows User Account Control (UAC) is a security measure in accordance with Microsoft to protect computers from "hackers and malicious software," but through a new trick to get around, as demonstrated by security researcher Cylance.

As software or a user wants to change some Windows settings or try to perform actions that require administrative privileges displays a UAC warning. Only when the user gives permission, the action will also be performed. In case the user does not have administrator rights, he must first enter the administrator password before the action is performed.

ShameOnUAC

Researcher Derek Soeder developed malware to attack it in Windows Explorer. The malware, Soeder "ShameOnUAC", and injects itself into the Explorer process which does not have administrator rights. Then watch this process until the user wants to start a program as an administrator. The application of this program to the administrator rights is manipulated by malware and provide any additional commands. For example, commands can through the command prompt in Windows are executed or made ​​changes to the Windows Registry.

Soeder explains that in case the user starts cmd.exe and then accept the UAC warning ShameOnUAC can first run a command with administrator rights before the user gets to see the command prompt. The attack is easy to prevent, users must namely "Show details" click in the UAC warning. The added jobs are namely displayed. However, it is up to the user to do so every time.

"It is important to note that UAC works just referred to. ShameOnUAC is eerie to see in action, because it shows that every user already malware inadvertently elevated privileges have been able to give that was the end of practice, the information by any time ignoring that they could observe it, "says the researcher. In the event malware administrative rights on a computer can get because attackers can take complete control over the system. Soeder himself says that he is always present after his research examines the details of a UAC warning.