Microsoft temporarily disables MSIX protocol handler following malware abuse
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-43890 | Spoofing Vulnerability in Microsoft Windows AppX Installer Actively Exploited CVE-2021-43890 is a spoofing vulnerability in the AppX Installer (App Installer) component of Microsoft Windows that allows a specially crafted package to masquerade as a trusted application. Triggering it requires user interaction: an attacker distributes a malicious installer package or ms-appinstaller link, typically via phishing, and must convince the user to open it, with impact limited to the privileges of the affected account. Successful exploitation delivers malware — Microsoft observed the Emotet, Trickbot and BazaLoader families in these attacks — and the flaw has also been used in ransomware campaigns, with users operating with administrative rights facing greater impact than low-privileged users. Essentially any Windows system relying on App Installer is affected; the exact affected build ranges are not enumerated in the advisory data, though contemporaneous headlines characterized it as an actively exploited Windows 10 zero-day addressed in the December 2021 Patch Tuesday. Exploitation is confirmed in the wild: CISA added it to KEV on 2021-12-15 with known ransomware use (EPSS 10.3% / 95th percentile), and in late 2023 Microsoft Threat Intelligence reported renewed abuse of the ms-appinstaller URI scheme and disabled that protocol by default in the updated App Installer. Do: Apply Microsoft's security updates per the vendor advisory (December 2021 Windows updates) and install the updated App Installer using the Microsoft Store links in the advisory. Verify the updated App Installer is in place and that the ms-appinstaller protocol handler is disabled — it is disabled by default in the December 27, 2023 App Installer update. Because exploitation depends on users opening crafted packages, prioritize patching systems where users run with administrative rights and remind users to treat app-installer links and attachments arriving via email or chat with caution. | 7.1 | 10% | KEV ransomware PoC |
| mass~1 billion+ Windows devices (App Installer ships as a built-in Windows component) |
Full article594 words · extracted from therecord.media · click to collapse
Microsoft has temporarily disabled the MSIX protocol handler in Windows installations after the Emotet gang has abused it over the past three months to deploy malware on user systems. The OS maker said it is working on ways to better protect this feature from future abuse but did not say when it expects to re-enable it back on. What is MSIX and the "ms-appinstaller" protocol handler Developed specifically for the launch of Windows 10, MSIX is a new file packaging format was designed around the concept of XML manifest files where developers can describe how the installation process can occur, what files are needed, and from where they can be retrieved. While it was initially made available for modern Windows versions, MSIX was backported to as far back as Windows 7 via MSIX Core, and today, MSIX-packaged files can be installed on all Windows OS versions. Typically, these files are served with extensions such as APPX or APPXBUNDLE, containing all the resources needed to install on any OS version. But when users double-click and execute the file, the OS reads the manifest files and only installs the files needed for their platform. However, for convenience, MSIX-packaged files can also be delivered via the internet via the "ms-appinstaller" protocol, which allows developers to create links like "ms-appinstaller:?source=//website.com/file.appx". In these instances, the MSIX protocol handler (ms-appinstaller) initially serves only the manifest XML files, and the OS only retrieves the files they need, saving bandwidth for the user. How MSIX attacks have been taking place But in late November 2021, the operators of the Emotet malware botnet have started abusing ms-appinstaller links for attacks against enterprise users. The group began sending emails, luring users to malicious sites. These sites would claim to contain important documents that recipients needed to view, but for which they needed to install a PDF component. But this link to the PDF component was actually an "ms-appinstaller://" that claimed to install an Adobe-signed file, but in reality, it installed a version of the BazarLoader malware. The problem with these attacks, and the reason why Microsoft disabled the protocol handler, was that the Emotet gang found a way to spoof signatures in MSIX-packaged files. While Microsoft delivered an initial patch for this issue (CVE-2021-43890) back in December—and even provided Group Policy-based defenses for those who could not update—attacks have continued to take place. Microsoft's recent move comes to curtail attacks abusing ms-appinstaller links by disabling the protocol handler itself. This means that these links will not work anymore. "If you utilize the ms-appinstaller protocol on your website, we recommend that you update the link to your application, removing 'ms-appinstaller:?source=' so that the MSIX package or App Installer file will be downloaded to user's machine," Microsoft said last week. "We recognize that this feature is critical for many enterprise organizations," it added. "We are looking into introducing a Group Policy that would allow IT administrators to re-enable the protocol and control usage of it within their organizations." 
BREAKING: #Emotet malspam links can since yesterday link to an Universal App installer hosted on @azure imposing as an Adobe Update that drops E4 payload. This is the same initial attack vector as #BazarLoader used a few weeks ago, even using the same @SectigoHQ cert. pic.twitter.com/B19KGFUtII— Cryptolaemus (@Cryptolaemus1) November 26, 2021
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/microsoft-temporarily-disables-msix-protocol-handler-following-malware-abuse