“Ransomware-Proof” Windows 10 S Hacked

Last month, Microsoft launched Windows 10 S, a security-focused iteration of its ubiquitous operating system. “Known ransomware” cannot infect Windows 10 S, says Microsoft. A hubristic claim, to be sure. Of course, that claim is now demonstrably false. Taking Microsoft’s boast as a challenge, ZDNet tried – and succeeded – to compromise Windows 10 S. The process took a matter of hours.

Windows 10 S Ransomware – “Surprisingly Easy”

ZDNet engaged Matthew Hickey to crack Microsoft’s supposedly invulnerable OS. Hickey, a security researcher and co-founder of Hacker House, cracked Windows 10 S within three hours. Hickey told ZDNet:

“I’m honestly surprised it was this easy. When I looked at the branding and the marketing for the new operating system, I thought they had further enhanced it. I would’ve wanted more restrictions on trying to run privileged processes instead of it being such a short process.”

So, how did Hickey compromise Windows 10 S? Through Microsoft Word.

Macro-Based Ransomware Attack

ZDNet explains how Hickey compromised Windows 10 S:

“Hickey created a malicious, macro-based Word document on his own computer that when opened would allow him to carry out a reflective DLL injection attack, allowing him to bypass the app store restrictions by injecting code into an existing, authorized process. In this case, Word was opened with administrative privileges through Windows’ Task Manager, a straightforward process given the offline user account by default has administrative privileges.”

Hickey bypassed Word’s “protected view” by uploading the document to a “safe” network share location.As a consequence, the macro grants him access to administrative privileges via a shell. He adds he could automate the process, given enough time.

Microsoft Remains Defiant

Microsoft has denied its Windows 10 S security claims are erroneous. Its argument, though, is a matter of semantics. The Redmond company counters that this particular attack was “new”. Therefore, its claim that Windows 10 S is not vulnerable to “known ransomware” is true. A Microsoft spokesperson said:

“In early June we stated that Windows 10 S was not vulnerable to any known ransomware, and based on the information we received from ZDNet that statement holds true. We recognize that new attacks and malware emerge continually, which is why [we] are committed to monitoring the threat landscape and working with responsible researchers to ensure that Windows 10 continues to provide the most secure experience possible for our customers.”

Is Microsoft just being pedantic? It wouldn’t have to if it didn’t make such conceited statements.