It seems something always happens when Microsoft tries a new security feature. According to Broken Browser, this time it’s the Microsoft Edge browser, the default browser in Windows 10, which can be tricked into issuing fake alerts.

Spoofing Microsoft Edge

SmartScreen is an Edge subprogram designed to keep users off malware-distributing sites. As quoted by Softpedia, “SmartScreen checks the sites you visit against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, SmartScreen will show you a warning letting you know that the site has been blocked for your safety.”

To do this, Edge locally maintains a dynamic list of bad URLs. If a user types in a blacklisted URL, the browser will not load the resource. Instead, it displays a message alerting the user that the content has been blocked.

This is where fraudsters try to sneak in, attempting to display their own image instead of the legitimate alert screen.

Current Windows apps use the protocols ms-appx: and ms-appx-web: to load internal resources. This is how Edge accesses the BlockSite list it needs to consult. But the protocols will also load other pages if those pages are correctly specified, which can lead to trouble.

One could call to create a new window and populate it with resources used by the BlockSite page. An impostor would look just like the legitimate BlockSite. Of course, the cybercriminals could also specify false information and populate the page with whatever they wanted.

A security researcher did just that. Along with a cheesy telephone support scam banner that he wrote, he showed how a telephone number could be inserted into such a window. Not only that, but Edge was ready to place the call for the victim.

Remote Possibilities?

It gets better: The researcher was also able to spoof Edge into showing that social media giant Facebook was an unsafe website just by including different code in the statement.

Just because someone can pull this off on a local machine doesn’t prove that this kind of thing can be done remotely. But it does raise the question of whether such an attack vector is possible. Fortunately, Windows 10 gets updated regularly. That will help ensure that this and similar situations are dealt with in a timely manner.

More from

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

Container Drift: Where Age isn’t Just a Number

Container orchestration frameworks like Kubernetes have brought about untold technological advances over the past decade. However, they have also enabled new attack vectors for bad actors to leverage. Before safely deploying an application, you must answer the following questions: How long should a container live? Does the container need to write any files during runtime? Determining the container’s lifetime and the context in which it runs is critical, especially when hosting an internet-facing service. What is Container Drift? When deploying…

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

OneNote, Many Problems? The New Phishing Framework

There are plenty of phish in the digital sea, and attackers are constantly looking for new bait that helps them bypass security perimeters and land in user inboxes. Their newest hook? OneNote documents. First noticed in December 2022, this phishing framework has seen success in fooling multiple antivirus (AV) tools by using .one file extensions, and January 2023 saw an attack uptick as compromises continued. While this novel notes approach will eventually be phased out as phishing defenses catch up,…