The important Windows command line element typed as regsvr32 or Microsoft Register Server (for a detailed understanding of Microsoft Register Server, please click here), is meant to file in the Dynamic Link Library or DLL (for a detailed understanding of Dynamic Link Library, please click here) in the Windows Registry. However, hackers have found a way to run and abuse the remote code from the net by bypassing whitelisting defences, particularly Microsoft’s AppLocker.
It is not known whether Microsoft will mend this condition with a security update, or they might have this sorted out in a whole new OS. Microsoft Register Server, more commonly know as regsvr32, is a Microsoft authorized binary that operates as a default element on Windows. Under a controlled environment, the specialist was able to discover the URL’s origins (the one that hackers use to remote control your machine) by running the Visual Basic Script (for a detailed understanding of Visual Basic Script, please click here) and JavaScript (for a detailed understanding of JavaScript, please click here) offered via the command line.
The specialist who discovered this flaw, also stated that a lot of trustworthy and protected sections of JavaScript and Visual Basic Script have zero limitation(s). Plus, the fact that the script is on a remote machine, makes it rather frivolous. In addition, the Microsoft Register Server is a proxy and is aware of the Secure Socket Layer, which means it needs no additional set-up. One has the ability to execute it from anywhere, as long as they are online. The security specialist stated that the problem was uncovered while investigating its bypasses. At the moment, there is no way to fix this problem. It is not an exploit, it is a genuine tool, but hackers always find a way to use it to their advantage.
However, the bothersome issue is that the Microsoft Register Server typically calls for administrative rights, which allows it to file the Component Object Model (for a detailed understanding of Component Objective Model, please click here) objects and DLLs in the operating system. So, generally, only users with administrative authority can execute it. But then again, the security specialist stated that he was able to execute it from a standard user profile.
Furthermore, the instructions on Microsoft Register Server do not mention that the Microsoft Register Server allows scripts from the web.
But one old program, what was known as the files trojan, used the operating system’s PowerShell (for a detailed understanding of PowerShell, please click here) to obtain the virus from the cyberspace, and it seems like this problem could be misused in a similar fashion.
The attack utilizing this technique will be challenging to discover. However, the only way for you to detect this activity in your system, is by executing another command line code known as – perfmon.msc – this will open a Performance Monitor Window, in which you will be able to monitor all the activity in your system (press 
+ R to open Run, then type perfmon.msx and press Enter). Or you can use PsTools, which has a more powerful set of commands, to monitor your system.
Source: SubTee, Softpedia News, Slash Dot
You want to support Anonymous Independent & Investigative News? Please, follow us on Twitter: Follow @AnonymousNewsHQ
This Article (A Small Command Can Bypass Windows AppLocker) is free and open source. You have permission to republish this article under a Creative Commons license with attribution to the author and AnonHQ.com.
