Microsoft has disabled a protocol that allowed the installation of Windows apps after finding that miscreants were abusing the mechanism to install malware.
The move came just before Christmas, and seemingly mimicked issues first reported in December 2021, to address a Windows AppX Installer vulnerability in which an attacker could spoof App Installer into installing malicious software.
Microsoft re-enabled the protocol, known as the ms-appinstaller URI scheme, on August 5, 2022, with the release of Windows 11 Insider Preview Build 25147.
It made the protocol available to some enterprise customers who chose to use it via the Local Group Policy Editor.
The ms-appinstaller URI scheme allows the MSIX package installer to install Windows apps from a web page using the local App Installer application.
Doing so allows installation without the need for local storage.
This has proven to be a popular feature, according to Microsoft.
Alas, as the Microsoft Threat Intelligence group noted last week, miscreants have been abusing the ms-appinstaller URI scheme to distribute malware.
It appears that the protocol provided a way around Microsoft's security checks.
For enterprise customers, pushing out a network-wide policy change may take some effort.
For those who rely on web-based installation as an app distribution channel, the consequence is a bit more friction for downloading and installation after proper checks.
This Cyber News was published on go.theregister.com. Publication date: Thu, 04 Jan 2024 00:43:05 +0000