Windows 10 UWP bug allowed full file system access without asking permission. A report by BleepingComputer has shed light on a Windows 10 bug that granted certain Universal Windows Platform (UWP) apps full access to a device’s file system, a great deal more than the expected limited file access. UWP apps are allowed to request this extra access, however, they are expected to explain to Microsoft what the access will be used for when submitting the app to the store. UWP apps that use this extra access are also supposed to prompt a settings screen with the ability to enable this access when the app is first used. Unfortunately, this screen wasn’t being prompted correctly and it doesn’t appear as if Microsoft is being that strict with app developers submitting such apps to the store. This settings prompt bug has apparently been fixed in the Window 10 October 2018 update though that update has been delayed due to some other, unrelated, bugs. You can read more about the nitty-gritty of this issue, and view some code samples, over on BleepingComputer.
Does this issue bother you? Share your thoughts with the community in the comments below.
Source: onmsft.com

No matter how robust an operating system is, it is difficult for it to be completely free of possible threats. Given that cybercriminals are constantly reinventing themselves, it follows that the same goes for cyberthreats. It is a constant cycle where any delay or slip up can open up new points of entry for unwanted visitors. And if operating systems are vulnerable, the companies using them are also vulnerable. In many cases, companies entrust their corporate cybersecurity to a single piece of default software; but experience shows that this is not enough. We now yet more proof of this. And what’s more, it affects a huge number of companies all over the world.
The vulnerabilities in Windows 10
This is exactly what has happened to Windows 10. Several vulnerabilities were found in this new version of the most widely used operating system in the world almost as soon as it was launched. But it has now set alarm bells ringing once again. In this case, the vulnerability is in ExploitGuard CFA File Creator, a tool provided by Windows in order for users to monitor the changes that certain programs are able to make to files within specific folders. The intention behind this tool was clear: it would allow the user to control possible unwanted access, and to avoid possible attacks from untrusted programs. And, put bluntly, the results couldn’t have been more counterproductive. As cybersecurity expert Soya Aoyama has demonstrated, there is a way to insert a malicious DLL so that, when Internet Explorer (which is on the CFA’s list of trusted programs) is run, ransomware can be inserted into the protected folders. I.e., this cyberattack takes advantage of a piece of software that is apparently harmless (Internet Explorer) in order to get into these folders. The worst thing about this may be the fact that, so far, Windows Defender, which has already had one or two problems itself, hasn’t been able to detect this problem on its system. And it doesn’t stop there: when Aoyama disclosed this vulnerability, the company didn’t feel it necessary to launch a patch, since, in their opinion, in order for the risk to be real, unauthorized access must have taken place before the DLL was launched. If we apply this to a corporate environment, the risks are clear. At the moment when the DLL arrives in an employee’s protected folders, it could set off a chain of attacks in the rest of the company, causing a serious corporate cybersecurity problem.

Read more: If your company uses Windows 10, watch out: there are new vulnerabilities about