OneDrive vulnerability breach: Bitdefender warns, Microsoft does not

IT security company Bitdefender is currently warning of a malware campaign by which fraudsters are trying to mine cryptocurrencies through a network of hacked PCs. The perfidy of it is the security gap – because it’s in OneDrive, but Microsoft takes no action.

Bitdefender had already detected about 700 attacked Microsoft OneDrive instances by May of this year. A security vulnerability related to sideloading in the DYNAMIC LINK LIBRARY (DLL) in Microsoft OneDrive is being exploited. The security firm handled this discovery in the familiar way: they contacted Microsoft, explained their findings and assumed Microsoft would issue a security update and warning. But none of that has happened so far.

“Microsoft does not interpret sideloading via a dynamic link library as a security vulnerability,” Bitdefender now writes in its disclosure of the vulnerability, explain ing what is behind the discovery and Microsoft’s response.

Performance affected

First, there is an active wave of attacks via the DLL vulnerability in OneDrive. Germany is one of the hardest hit countries. The sideloading vulnerability is currently being used to perform cryptomining using the hacked sources. Victims of the hack notice losses in system performance. However, the vulnerability is also suitable for ransomware attacks or infection with spyware.

Take precautions

Microsoft currently sees no need for action. Cybercriminals abuse a regular function of the database, so a software update would be ineffective. Instead, Microsoft suggests precautionary measures. Users can install Microsoft OneDrive “per user” or “per machine”. The default setting is “per user” installation. In this configuration, users without special privileges can write to the folder in which OneDrive resides.

Hackers can place malicious malware here, modify executable files or overwrite them completely. Microsoft therefore recommends installing the OneDrive “on a per machine basis.” Instructions on how to do this can be found at: https://learn.microsoft.com/en-us/onedrive/per-machine-installation, Bitdefender explains. However, the “per machine” installation is not for everyone. Bitdefender therefore warns OneDrive users to be very careful: “Both virus protection and the operating system used should always be updated.

Source: researchsnipers