• Newly discovered data access breach in Win10 UWP (Metro, “Store”) apps

    Posted on October 27, 2018 at 14:29 CDT by • Comment in the Forums

    There’s a bug in the UWP API that lets appropriately programmed apps look at all of your data. Günter Born says:

    (The malicious UWP) app is not limited to access to files and folders via a file picker or LocalStorage. Microsoft has described the permitted file system accesses in this document (broadFileSystemAccess API). The documentation also states: “On first use, the system prompts the user to allow access”. Microsoft (theoretically) provides security measures for access that intercept unauthorized access attempts. Without user access, a UWP app cannot access files without the user’s consent – at least theoretically …

    Unfortunately, there’s a bug that prevents the security prompt from appearing. Microsoft apparently tried to fix the bug in Win10 1809, but the guy who discovered the bug, Sébastien Lachance, says that trying to run the API-calling code crashed the app.

    (No details offered about which version of 1809 he tried.)

    In the meantime, it appears as if 1803 and earlier are still subject to the bug.

    Windows Patches/Security
DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    March 2025
    S M T W T F S
     1
    2345678
    9101112131415
    16171819202122
    23242526272829
    3031  

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.