A new zero-day vulnerability in Windows • Blisstech Solutions

Introduction

A new zero-day vulnerability in Windows Search has been discovered which can be exploited to automatically open a malicious search window containing remotely-hosted malware executables. The vulnerability is triggered when a user launches a Word document, and can be used to target users across all versions of Windows. Microsoft has yet to release a patch for the vulnerability, so users are advised to exercise caution when opening Word documents from untrusted sources.

What is a zero-day vulnerability and why should I care about it

A zero-day vulnerability is a security hole in software that is unknown to the vendor. These vulnerabilities are highly prized by hackers, as they can be used to exploit systems using vulnerabilities that are yet unknown and are not patched.

Zero-day vulnerabilities are a serious threat to users, as they can be used to exploit systems without the user’s knowledge. In the case of the Windows Search vulnerability, a malicious script can be embedded in a Word document which, when opened by the user, will automatically open a search window containing remote-hosted malware executables. The malware then proceeds to infect the user’s machine.

The exploit in Windows Search and how it works

Windows Search is a built-in search feature in Windows that allows users to search for files and folders on their computer. The Windows Search vulnerability discovered by security researchers can be combined with another zero-day (CVE-2022-30190) and allows attackers to exploit the feature to automatically open a malicious search window containing remotely-hosted malware executables.

The exploit is activated when a user opens a Word document containing a malicious script. When the document is opened, the script automatically runs and opens a search window containing remote-hosted malware executables.

The impact of the exploit

Windows Search is a crucial component of the Windows operating system, used by millions of users every day to find files and folders on their computers. The vulnerability can be triggered by just previewing an Office document, and can be used to target users across all versions of Windows.

The recent discovery of a zero-day vulnerability in Windows Search has raised concerns among security experts, as the exploit can be used to automatically open a malicious search window containing remotely-hosted malware executables.

Using social engineering, the attackers would entice the user to run the malware by claiming they are critical updates or something else that creates a sense of urgency. Then the malware would proceed to infect the user’s machine.

How to protect yourself from the exploit

There are a few things you can do to protect yourself from the Windows Search exploit:

  • Do not open, or even preview, Office documents from untrusted sources.
  • Make sure your antivirus software is up-to-date.
  • Do not use an admin account for day to day activity. Admin rights are needed by most malware, so removing admin rights is one of the best forms of protection.
  • Educate your users on this threat and the risks.

In Conclusion

The recent discovery of a zero-day vulnerability in Windows Search has raised concerns among security experts, as the exploit can be used to automatically open a malicious search window containing remotely-hosted malware executables.

The exploit is triggered when a user launches an Office document, and can be used to target users across all versions of Windows. Microsoft has yet to release a patch for the vulnerability, so users are advised to exercise caution when opening Office documents from untrusted sources.

By following the security measures outlined above, you can help protect yourself and your organization from this dangerous exploit.

Want to discuss your businesses cybersecurity with an expert?  Why not get in touch?

More Content

Cyber attacks are getting bigger and smarter. Are you vulnerable?

Recently, the biggest ever DDoS attack was reportedly blocked. Worse still, more businesses are being targeted with criminals demanding huge ransoms

A free tool for more polished communication

A free tool for more polished communication

You’ve hit send on an important email – then you notice a typo. Windows 11 lets you spellcheck and autocorrect across most of its apps. Here we help you to set it up

PING, WHOOSH, or BEEP? Now you can decide with Teams

PING, WHOOSH, or BEEP? Now you can decide with Teams

Is the sound of yet another Teams notification about to drive you crazy? A new update will put a stop to that… and it’ll help you prioritize your tasks too. We have all the details here.

Zoom wants to be the new Teams

Zoom is looking for a piece of the MS Teams action with the launch of a whole suite of features and services

Why you’re better off in a contract with your IT company

Imagine this: Your business stops working due to a tech issue like malware, data loss or computer malfunction, resulting in a loss of productivity and revenue.  Now, think about your current IT support situation. Do you have an IT support contract, or do you only call...

Is your business data at risk? Don’t take chances with old tech

Old computers and external drives can put your sensitive business data at risk.
We look at how to dispose of old computers and external drives in the safest way possible.

New phishing scam is smarter than ever… here’s how to protect your business

New Microsoft 365 phishing scam is smarter than ever… here’s how to protect your business

Microsoft is warning business owners that trusted cloud storage services are being hijacked to trick you into handing over your data. Here we tell you what you need to know.

Bridging the trust gap between your employees and AI

Bridging the trust gap between your employees and AI

Have you noticed your employees are reluctant to use AI in the workplace? It may be down to their lack of trust. We explain how to show them AI is a tool that makes work better for everyone.

OneDrive Backup Tip Video Thumbnail

Tech Tip: Using OneDrive to automate backups

Happy Tuesday everyone! Today's Tech Tip is a tip on how to use OneDrive to automate the backup of Known Folders. Known Folders are what Microsoft call your Documents, Desktop and Pictures folders in your Windows profile. If you are like most people, you will accept...

3 essential security tools for every business

Your data is one of your most valuable business assets. Keeping it safe should be one of your main priorities.

Share This
Contact
Love Lane
Cleobury Mortimer
Shropshire DY14 8PE

01299 382 321
[email protected]
Copyright © 2024 Blisstech Solution Ltd
Registered No: 08125391 VAT No : 307 5490 05