Ever wondered how Windows decides if a file path is local, intranet, or Internet, and why it matters for security? Our latest blog from MSRC Senior Security Research Managers George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas) dives deep into MapUrlToZone (MUTZ), the critical Windows component that helps protect users from credential leaks and remote code execution.
In this blog, you’ll learn:
➤ How MUTZ works behind the scenes
➤ Real-world vulnerabilities and CVEs discovered by Microsoft researchers
➤ The latest fixes and what they mean for Windows security
Check out our latest blog post and see how MSRC is strengthening defenses for everyone: https://t.co/acEVhEhPUe
At @defcon 33, George Hughey (@ecthr0s) and Rohit Mothe (@rohitwas), Senior Security Research Managers at MSRC, took us back to the 90s with their talk on the ghost of Internet Explorer in Windows: MapUrlToZone.
They uncovered how this legacy API, used by Outlook, Office, Windows Shell, and sandboxes to make security decisions, was vulnerable to manipulation. Their deep dive revealed a dozen CVEs and led to systemic mitigations across Microsoft platforms.
Learn how MSRC’s technical investigations drive proactive protection for customers and why legacy code still matters in the slides available here: https://t.co/DSORcAoePz
#DEFCON #DEFCON33
At @defcon, the MSRC team had a great time connecting with the security community and cheering on Microsoft employees, MVRs, and other Microsoft security researchers as they shared their expertise through presentations and hands-on collaboration.
#DEFCON#DEFCON33
This week's Patch Tuesday included 8 CVEs that @rohitwas and I found!
We've been focusing on findings ways to bypass MapUrlToZone and found several very interesting ways to confuse it. This is an API we've seen a lot of interest in lately, so good to have it locked down!
We're super proud of this work - it took a lot of poking around in Windows Internals and a huge effort from Engineering to fix all these issues. Many thanks to all who worked on these :)
As many of these exploit differences in CreateFile and MUTZ, we've duplicated some of the behavior in CreateFile. This should help prevent similar bypasses in the future. We're planning on releasing more info about this research over the coming months, so stay tuned!
To help protect against NTLM relay attacks, we’ve enabled Extended Protection for Authentication (EPA) by default in Windows Server 2025. This update strengthens key services like Exchange Server, Active Directory Certificate Services (AD CS), and LDAP, making identity compromise and unauthorized access more difficult.
Learn more about these security improvements and how they can help protect your systems in our blog post: https://t.co/Ri1wnV8xkG
My 50th CVE came out in today's Patch Tuesday! CVE-2024-38240 is the last of some hardening we've been doing in a Windows service, and CVE-2024-38252/CVE-2024-38253 are two proactive efforts we worked on with some static analysis friends :)
CanSecWest Presentation:
Rolling in the Dough: How Microsoft Identified and Remediated a Baker’s Dozen of Security Threats in the Windows DNS Server
George Hughey, Microsoft
https://t.co/0wkkZ7tzu2
Yesterday's Patch Tuesday saw the release of 10 CVEs I found in DNS! These could potentially allow an authenticated attacker to gain remote code execution. A huge thank you to the DNS team who worked through and fixed these.
https://t.co/78wxsVh385