Categories: News

“Ransomware-Proof” Windows 10 S Hacked

Last month, Microsoft launched Windows 10 S, a security-focused iteration of its ubiquitous operating system. “Known ransomware” cannot infect Windows 10 S, says Microsoft. A hubristic claim, to be sure. Of course, that claim is now demonstrably false. Taking Microsoft’s boast as a challenge, ZDNet tried – and succeeded – to compromise Windows 10 S. The process took a matter of hours.

Windows 10 S Ransomware – “Surprisingly Easy”

ZDNet engaged Matthew Hickey to crack Microsoft’s supposedly invulnerable OS. Hickey, a security researcher and co-founder of Hacker House, cracked Windows 10 S within three hours. Hickey told ZDNet:

“I’m honestly surprised it was this easy. When I looked at the branding and the marketing for the new operating system, I thought they had further enhanced it. I would’ve wanted more restrictions on trying to run privileged processes instead of it being such a short process.”

So, how did Hickey compromise Windows 10 S? Through Microsoft Word.

Macro-Based Ransomware Attack

ZDNet explains how Hickey compromised Windows 10 S:

“Hickey created a malicious, macro-based Word document on his own computer that when opened would allow him to carry out a reflective DLL injection attack, allowing him to bypass the app store restrictions by injecting code into an existing, authorized process. In this case, Word was opened with administrative privileges through Windows’ Task Manager, a straightforward process given the offline user account by default has administrative privileges.”

Hickey bypassed Word’s “protected view” by uploading the document to a “safe” network share location.As a consequence, the macro grants him access to administrative privileges via a shell. He adds he could automate the process, given enough time.

Microsoft Remains Defiant

Microsoft has denied its Windows 10 S security claims are erroneous. Its argument, though, is a matter of semantics. The Redmond company counters that this particular attack was “new”. Therefore, its claim that Windows 10 S is not vulnerable to “known ransomware” is true. A Microsoft spokesperson said:

“In early June we stated that Windows 10 S was not vulnerable to any known ransomware, and based on the information we received from ZDNet that statement holds true. We recognize that new attacks and malware emerge continually, which is why [we] are committed to monitoring the threat landscape and working with responsible researchers to ensure that Windows 10 continues to provide the most secure experience possible for our customers.”

Is Microsoft just being pedantic? It wouldn’t have to if it didn’t make such conceited statements.

Ashley Allen

Disqus Comments Loading...

Recent Posts

AOC 24G2ZU 240Hz IPS Gaming Monitor Review

Monitors are not created equally, and when it comes to gaming monitors, even relatively small…

13 hours ago

UK Introduces New In-Game Ad/Microtransactions Rules!

Microtransactions and in-game advertisements are undoubtedly a huge and very lucrative part of gaming. Particularly…

16 hours ago

Intel i9-12900K Benchmark Hints at Huge Single-Core Performance Gain!

With Intel's 12th-gen Alder Lake-S processors almost certainly due for release in less than 2…

16 hours ago

Crypto Mining Company Buys Power Plant to Solve Energy Problems!

While Cryptocurrency mining can be an exceptionally lucrative industry, it does generally come with two…

16 hours ago

Leaked Internal Document Hints at Intel GPU Naming Structure

With the release of Intel's dedicated gaming graphics cards, slowly but surely, inching ever closer,…

16 hours ago

Apple iPhone 14 to See a ‘Complete Redesign’

While the Apple iPhone 13 has proven to be (perhaps surprisingly) very popular with consumers,…

16 hours ago