Security researchers successfully hijack Windows 11 Power Automate tool
In a nutshell: Windows 11 includes tools to automate repetitive tasks, saving users a lot of time. However, one security researcher says it can also save hackers a lot of time. Microsoft questions the vulnerability of its automation tools, but as usual regarding cybersecurity, human complacency may be the weakest link. Security researchers successfully hijack Windows 11 Power Automate tool.
Microsoft wrote about a 2020 incident in which attackers used a company's automation tools against it. Windows 11 and Power Automate weren't around back then, but the case provides a real-world example of the same fundamental technique.
A research firm recently published methods for attackers to hijack automation tools that ship with Windows 11 to distribute malware and steal data across networks. The process comes with some caveats but marks another area of concern for IT security.
A Windows 11 Automation Tool Can Easily Be Hijacked
The vulnerability centers on Power Automate, a tool Microsoft packages with Windows 11 that lets users automate tedious or repetitive asks across various programs. Users can automatically backup files, convert batches of files, move data between programs, and more, optionally automating actions across groups through a cloud. Power Automate comes with many pre-made functions, but users can create new ones by recording their actions, which the tool can later repeat. The program could gain widespread use because it requires little-to-no coding knowledge.Getting started with Power Automate in Windows 11
Michael Bargery, CTO of security company Zenith, thinks attackers can use Power Automate to more quickly spread malware payloads, explaining how in a June Deacon presentation. He released the code for the attack, called Power PW, in August. The biggest obstacle to hacking with Power Automate is the fact that an attacker needs to already have access to someone's computer or have penetrated a network through other nefarious methods. Bargery told Wired that if an attacker then creates a Microsoft cloud account with administrative privileges, they can use automated processes to push ransomware or steal authentication tokens. Attacks using Power Automate could be harder to detect because it technically isn't malware and carries an official Microsoft signature.No-Code Malware: Windows 11 At Your Service
Microsoft claims any fully updated system can defend against such threats and that networks can isolate compromised systems with registry entries. However, these safeguards, like all others, require prudence that users and companies don't always exhibit.
