A supposedly new vulnerability is making its way through tech news right now. The original source claims to have discovered a new zero-day vulnerability affecting many antivirus engines and possibly every program on Windows.
However, as far as I can tell:
- This requires write privileges on
HKEY_LOCAL_MACHINE, which means the attacker must already have administrative privileges.
- This appears to be just another method for performing a DLL injection, hardly a new concept - especially if you already have admin privileges!
- The (ab)use of Application Verifier custom providers to inject arbitrary DLLs does not appear to be a new concept.
But it's been claimed as a new zero-day, there've been a number of CVEs assigned, and it looks to be taking off in the news. What's different about it? And how can I mitigate it on my systems?