RedSun: System user access on Win 11/10 and Server with the April 2026 Update (github.com)

by airhangerf15 65 comments 195 points
Read article View on HN

65 comments

[−] egeozcan 29d ago
I wonder why Windows Defender has the privilege to alter the system files. Read them for analysis? Sure! Reset (as in, call some windows API to have it replaced with the original), why not? But being able to write sounds like a bad idea.

However, I don't know what I'm talking about so take it with a grain of salt!

[−] EvanAnderson 29d ago
AV had traditionally run as SYSTEM on Windows (and, in the past, often had kernel mode drivers too). I've always thought it was a terrible idea. It opens up exciting new attack surfaces. Kaspersky and McAfee both had privilege escalation vulnerabilities that I can recall. There have been a ton in multiple products over the years.
[−] labelbabyjunior 29d ago
They kind of have to, though.

If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?

AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.

[−] EvanAnderson 29d ago
The OS should do the SYSTEM-level lifting and scanning processes and behavior analysis should run sandboxed as low priv processes. It would require a clearly defined API and I feel like MSFT was always reticent to commit, leaving AV manufacturers to create hacky nightmares.
[−] labelbabyjunior 29d ago
Well the OS should do nothing—remember MS was taken to court over that—but better privsep on the part of the AV, sure.

Technically, Defender can be replaced with 3rd party AV.

[−] bux93 29d ago
Windows has separate SeBackupPrivilege for backup software, so why not for AV?
[−] arcfour 28d ago
What would this privilege look like that is meaningfully different from SYSTEM while being properly protected from/able to deal with malware that has an LPE?
[−] formerly_proven 29d ago
“Because the remediation component requires SYSTEM, the entire AV needs to run as SYSTEM and we have to unpack malware in the kernel”
[−] Fokamul 29d ago
Because to get Ring0, you just need signed vulnerable driver.

There are tons of signed drivers to explore ;-)

[−] labelbabyjunior 29d ago
Some files under Windows are protected as the TrustedInstaller user, which is a more restrictive level of permissions than SYSTEM.
[−] lexicality 29d ago
helpfully the user provides a second tool which automatically turns off Windows Defender so you can't be affected by this: https://github.com/Nightmare-Eclipse/UnDefend
[−] layer8 29d ago

> It runs in two modes, passive and aggressive

Lol

[−] hulitu 28d ago
Unlike Windows Defender which is passive aggressive.
[−] IFC_LLC 29d ago
I remember the times when Microsoft had a lot of problems 20 years ago because of Sasser and other viruses that were taking over Windows. They did not have any contenders. Yet they have stopped any software development for 9 months just to re-work their entire codebase to prevent things like direct memory execution and stuff like that. The result of that was Windows XP Service Pack 2. After that thing windows XP became a legend.

Now, when Linux is slowly creeping on one side, and Mac NEO on another they keep releasing this AI-slop.

By the looks of it they make most of their money from the cloud and other software things nowadays. And Windows has become a sidekick in their processes.

[−] toyg 29d ago
I don't think SP2 made much of a difference in the popularity of XP. It was already dominant, and it's mostly remembered as "legendary" because it had become the target platform for every hardware and software vendor on the planet. Windows 98 was too flaky to engender any serious friction to upgrades, and Windows 2000 was not consumer-friendly enough; XP effectively unified the consumer and professional desktop markets, and became the gold standard.

SP2, if anything, slowed down adoption, since it threw a bunch of spanners in the way of third-party code. It was probably necessary, just to stem the flow of bad press, but no mean a key in XP's overall success.

[−] IFC_LLC 29d ago
It was not that bad. I remember when SP fixed a bunch of issues with bluetooth, and windows CD burning program was better than any of the Nero Burning ROMs, cause those became unusable overbloated.
[−] steve1977 28d ago
Also, technically XP was Windows NT 5.1, so it was built on a solid basis.

Whereas 98 was still in the kinda DOS-based 9x line.

And I fully agree with you to not mention Windows Me.

[−] toyg 26d ago
Windows Me was some weird marketing attempt at squeezing more life out of the dead-end '9x line. I honestly don't know who, in their sane mind, would ever pay for such a thing.
[−] hulitu 28d ago

> I don't think SP2 made much of a difference in the popularity of XP

The general knowledge was to wait until the SP were stable. This was hard. 4.0 had SP6, 2k had SP4.

[−] hulitu 24d ago

> I don't think SP2 made much of a difference in the popularity of XP

SP1 was buggy as hell.

[−] nailer 29d ago

> Windows XP Service Pack 2. After that thing windows XP became a legend.

God that was an era. XP SP2 was a great OS, IE was the best browser, MSN was the most popular messenger, Skype was acquired, HTC's Windows CE devices were shipping real web browsers that worked over 3G.

By the end of the Ballmer era, Microsoft has lost the OS, the browser, the messenger, the meeting service and mobile.

[−] orbital-decay 28d ago
There were several points in time (after the SP2 too) when installing WinXP with an active internet connection was nearly impossible, because it would get infected during the installation and shut itself down halfway through it.
[−] hathym 29d ago
cl /std:c++17 /EHsc /W4 /O2 /DUNICODE /D_UNICODE /wd4005 /Fe:RedSun.exe RedSun.cpp advapi32.lib ole32.lib user32.lib
[−] ranger_danger 29d ago

> normally I would just drop the PoC code and let people figure it out

Looks like that's exactly what they did though?

Or maybe they just meant that they don't usually explain how it works?

[−] Implement7347 29d ago
I'd love to think that this person is a rogue AI, (better than Claude mythos?) Dropping two zero days in one month is pretty interesting. Nice work.
[−] Dwedit 28d ago
Any way to disable the entire cloud tag system?
[−] luma 29d ago
Tried to download and Defender blocks it.
[−] labelbabyjunior 29d ago
A local privilege escalation to root via an exploitable service?

Doesn't Linux have one of these CVEs...each week?