Google has discovered a security vulnerability in Windows 10 S, the version of Windows 10 that Microsoft touts as the most secure because it restricts users from running Win32 apps. The vulnerability allows arbitrary code execution on devices with Device Guard enabled, but according to a post by Neowin, a successful exploit requires access to the system. The vulnerability was discovered by Google’s Project Zero program, which gives interested parties a 90-day deadline to fix bugs in their software. Microsoft, however, appears to have requested an extension to the deadline, after previously releasing an update for the vulnerability in January. The company was then preparing a fix for April, but apparently was unable to complete it, asking for a deadline until May. However, Google refused to give another delay to the publication of the vulnerability, and as of today, all the details are circulating online. The Windows 10 S flaw is particularly difficult to exploit, but if someone manages to do it, the “most secure Windows system” will be a walk in the park. Windows 10 S does not allow the installation of Win32 software and Microsoft allows upgrading to Windows 10 Pro directly from within the operating system. However, the availability of Windows 10 S as a standalone operating system will soon stop and it will be integrated into Windows 10 as “S Mode”. So although Microsoft has promised a patch on May’s Patch Tuesday, it is not certain that it will be released, as the plan is to integrate the operating system as a feature of the company’s main OS, namely Windows 10. If you are interested in more technical details and want the PoC of the vulnerability, you can find it on Google’s Project Zero announcement page
- Subs Heroes Italian documentary about underground translators
- Microsoft's Anti-Phishing technology comes as an extension to Google Chrome
