Notices by James Forshaw :donor: (tiraniddo@infosec.exchange)

My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D

I wasn't imagining things, Administrator Protection has indeed been pulled for now. https://learn.microsoft.com/en-us/windows/security/application-security/application-control/administrator-protection/?tabs=intune#system-requirements

Neat!

@GossiTheDog unsafe BinaryFormatter usage has been on the shit list for at least a decade, this should have been found in less than a hour with grep. This should never have been in the code so long, it should have been audited out.

@GossiTheDog honestly, just calling the bug RCE almost undersells the damage this bug can do. Such as stupid bug as well.

Seems Windows 11 25H2 is finally rolling out, and they're shipping the new Administrator Protection feature. Hopefully MS should have fixed 6 bypasses I found in it during insider preview :D

@GossiTheDog creative for sure, but I wonder if there's not other places that could force a process to suspend at least if you already have admin access. Ultimately EDR lives and dies by it's ability to catch the malware before it disables the EDR. Not sure how MS would fix this in the OS.

@GossiTheDog Errata ID [sic] is just too complex for it's own good. It's like they looked at AD, and went "What if more, and harder to reason about", then bolted on on-prem AD connection for good measure.

@GossiTheDog such a valuable feature then, but I shouldn't need to do stupid approaches to bypass it. Honestly I wouldn't really care if it blocked "adult content" in the feed, as that could always be disabled. But I have no idea what they were thinking when they decided that DMs were needing of age verification.

While I've always focussed on using Mastodon I did try and give Bluesky a go, but the community doesn't seem there and I never got much engagement on security topics. Bluesky's decisions regarding the stupid UK's Online Safety Act to make DMs locked behind age verification is the final straw, so I've deactivated the account and maybe it'll get deleted eventually. I'll go back to not posting anything exclusively on here :D

@GossiTheDog "Gone are the days of trying to memorize and remember file names or exact words. With improved Windows search..." we can shove AI generated garbage straight from Bing to your eyeballs with no way of disabling any of it if all you wanted was finding your own files.

@GossiTheDog I still can't quite believe _this_ was their fix.

@GossiTheDog I never managed to the get the updated version working on the ARM CoPilot laptop I bought specifically for that purpose. I don't know of any current write ups other than the puffery from MS.

I'd certainly focus on the encryption, how it ties into Windows Hello, whether there's any obvious bypasses and also whether you can still hoover up the details _if_ the user has unlocked it first (as in how hard is it to access the database once the key is available).

@GossiTheDog FFS

@GossiTheDog comical :D

@GossiTheDog as far as I know mine doesn't crash but it's still yet to capture a single snapshot. I did take a look an the enclave binaries though, first (and minimal) pass seems it's "maybe better", at least no obvious bug assuming they're using it correctly.

Awesome that MS are supported and documenting VBS enclaves properly now *apropos of nothing in particular*. https://learn.microsoft.com/en-us/windows/win32/trusted-execution/vbs-enclaves-dev-guide. Also awesome that in the example exported entry point they provide they don't seem to mention how careful you need to be with the input pointer that you don't just read/write enclave memory :)

@GossiTheDog @SteveSyfuhs well I meant I bought a *urgh* Copilot+ ARM PC for it, sorry.

@SteveSyfuhs @GossiTheDog I was able to install it on my ARM device bought almost for this exact purpose (oddly they didn't ship to Canary, I had to full reinstall the OS to move back to the Dev channel). I'll try and take a poke at it now I'm not at work, see if I can get $20k out of MS :D

@GossiTheDog from the article "a sentencing hearing was postponed for a 12-year-old boy who admitted taking part in two separate incidents of disorder in Manchester because his mother had gone on holiday to Ibiza". Hmm I wonder what could possibly be the root problem of the boys misdeeds?