Security Now 1023: Preventing Windows Sandbox Abuse
Released on April 30, 2025
Hosted by TWiT’s Leo Laporte and Steve Gibson

Introduction

In Episode 1023 of Security Now, host Leo Laporte and security expert Steve Gibson delve into a range of pressing cybersecurity issues. This episode, titled "Preventing Windows Sandbox Abuse," explores the enigmatic creation of the inetpub directory in Windows, new vulnerabilities leading to SSD data loss, malware exploitation of Windows Sandbox, sophisticated cyberattacks by North Korean actors, and emerging threats targeting GPT-style AI models.

InetPub Directory Mystery

Overview: Steve Gibson introduces the mysterious appearance of the inetpub directory on Windows 11 machines following April's Patch Tuesday updates. Originally associated with Microsoft's Internet Information Services (IIS), many users found this directory appearing unexpectedly, leading to confusion and alarm.

Key Points:

• Microsoft's Fix for CVE-2025-21204: The creation of the inetpub folder is part of a security patch addressing a privilege escalation vulnerability. However, Microsoft provided minimal explanation, advising users not to delete the directory without clarifying its purpose.

• Steve’s Investigation: By setting up a fresh Windows 11 virtual machine, Steve confirms the automatic creation of the empty inetpub folder, owned by the system. Deleting this directory disrupts the security patch, forcing users to install IIS to restore it—a solution deemed overly cumbersome and inefficient.

Notable Quotes:

• Steve Gibson [01:54]: “Eternal gratitude. Thank you.”
• Leo Laporte [02:42]: “When I first moved to San Francisco, the first place I rented the address was 1024 Page Street. Ah. And I thought no one else appreciated it, but I thought, this is cool.”
• Steve Gibson [21:35]: “This is as half-baked as anything I've ever seen.”

Data Loss in SSDs

Overview: The episode addresses concerns about data retention in solid-state drives (SSDs) when left unpowered. Drawing from research highlighted by Tom's Hardware and insights from listener feedback, Steve explains the physical limitations of SSDs that lead to data degradation over time.

Key Points:

• Research Findings: Tom's Hardware reported that unpowered SSDs can lose data over extended periods due to electron leakage from NAND cells, exacerbated by wear from frequent write cycles.

• Steve’s Explanation: Repeatedly writing data to SSDs weakens the dielectric insulation of flash memory cells, increasing the likelihood of data corruption and reduced read performance. Temperature also plays a critical role, with higher temperatures accelerating electron migration.

• Mitigation Strategies: Steve recommends regularly rewriting data on SSDs using tools like Spinrite to restore data integrity and storing SSDs in cool environments to minimize data loss.

Notable Quotes:

• Steve Gibson [06:30]: “Well, here's the thing is, it's about...”
• Leo Laporte [74:23]: “It’s not a hardware failure. It’s just the data needs to be refreshed.”

Malware Abusing Windows Sandbox

Overview: A significant portion of the episode focuses on how malware is exploiting Windows Sandbox—a feature designed to safely run untrusted applications—to hide malicious activities within compromised systems.

Key Points:

• Technique Exploitation: Malware authors circumvent Windows Sandbox’s default security by launching sandbox instances in the background under different user accounts, making them invisible to the logged-in user and evading antivirus scans.

• Advanced Persistent Threats (APTs): The Chinese cyber espionage group Mirror Face (also known as Earth, Kasha, and Apt10) has been identified using this method since 2023 to maintain undetected persistence within targeted networks.

• Detection and Prevention: Steve and Leo discuss strategies to mitigate this threat, including disabling virtualization extensions in the BIOS (Intel VT-x) for users who do not require virtualization features and employing Windows AppLocker to block the execution of WindowsSandbox.exe.

Notable Quotes:

• Steve Gibson [138:13]: “Malware has figured out, hey, there's this cool thing called Windows Sandbox. Let's hide in there.”
• Leo Laporte [160:37]: “Do they do that? They install virtual machines?”

North Korea’s Fake US Companies

Overview: The episode sheds light on how North Korean threat actors are establishing fake US-based cryptocurrency companies to infiltrate and distribute malware.

Key Points:

• Discovery by Silent Push: Security researchers identified three cryptocurrency companies—Block Novus LLC, Angeloper Agency, and Soft Glide LLC—as fronts for North Korean APT group Contagious Interview. These entities use AI-generated profiles and deceptive job postings to distribute malware to unsuspecting applicants.

• Malware Strains: The fake companies deploy malware strains named Beaver Tail, Invisible Ferret, and Otter Cookie through infected job applications, compromising both the applicants’ personal systems and their employers' networks.

Notable Quotes:

• Steve Gibson [49:30]: “...North Korean hackers created and used US front companies and I found two of them.”
• Leo Laporte [47:59]: “Wow. What a great real life example of the mixed blessing consequences of increasing security.”

Attacks on GPT-Style AI: Inception Attack

Overview: Emerging vulnerabilities in GPT-style conversational AIs are introduced, specifically the "Inception Attack," which allows malicious actors to bypass safety mechanisms and generate harmful content.

Key Points:

• Systemic Weaknesses: Researchers from Carnegie Mellon University’s CERT Coordination Center identified two systemic jailbreaks affecting multiple AI models, including ChatGPT, Claude, Copilot, Deep Seek, Gemini, Grok, and Mistral AI.

• Inception Jailbreak: By embedding commands within fictitious scenarios, attackers can trick AIs into ignoring their safety protocols, allowing the generation of illicit content such as phishing emails, malware code, and information on controlled substances.

• Security Implications: The systemic nature of these vulnerabilities poses significant risks, as legitimate AI services could be exploited as proxies for malicious activities, complicating detection and mitigation efforts.

Notable Quotes:

• Steve Gibson [58:25]: “And I think of my own far simpler coding experiences and it becomes very clear that this incredibly fuzzy world of AI... has a far longer way to go before we're able to get a grip on it.”
• Leo Laporte [59:25]: “Yeah, although I'm kind of have mixed feelings about AI safety.”

Picture of the Week: Emergency Boiler Shutoff

Overview: Steve shares a humorous yet thought-provoking "Picture of the Week" featuring an emergency boiler shutoff switch with ambiguous labeling.

Key Points:

• Description: The image depicts a bright red boiler shutoff switch labeled identically on both sides, leaving users uncertain about which direction to toggle in an emergency.

• Discussion: Steve and Leo humorously debate the switch's functionality, using it as a metaphor for poor user interface design and its potential safety implications.

Notable Quotes:

• Steve Gibson [12:45]: “User interface design is an art.”
• Leo Laporte [14:04]: “Yeah, turn on the shut off or turn off.”

Listener Feedback and Questions

Overview: The episode features insightful feedback and questions from listeners, highlighting real-world applications and concerns related to discussed topics.

Key Contributions:

• John Canfield: Discusses the utility of Windows Sandbox in Windows 10X projects and its relevance to running Win32 apps in containers.

• Antoine Chopin: Raises concerns about the security implications if the host OS is compromised, questioning the isolation effectiveness of Windows Sandbox.

• Brian: Expresses admiration for Spinrite and inquires about the possibility of open-sourcing the tool.

• Galen: Shares experiences with SSH brute-force attacks and emphasizes the importance of robust SSH security measures.

• Matt Davis: Reports complications with Let’s Encrypt certificate renewals after implementing country-wide traffic blocking, illustrating the trade-offs in tightening security measures.

• Darrell McKinnon: Questions the safety of the "Trust this computer" option for websites on private networks, prompting a detailed explanation of browser cookies and session management.

Notable Quotes:

• Steve Gibson [86:05]: “So I chose John's question because it serves to highlight one of the reasons why Microsoft's implementation of Windows Sandbox is so economical.”
• Leo Laporte [97:50]: “I’m so glad you asked, Mr. Gibson.”
• Steve Gibson [99:08]: “I've seen days with up to 5,000 unique IPs banned.”
• Steve Gibson [131:06]: “We have, we've said enough.”

Recommendations and Solutions

Preventing Windows Sandbox Abuse: Steve outlines effective measures to safeguard systems against the abuse of Windows Sandbox by malicious actors:

1. Disable Virtualization Extensions:

   • Method: Access the system's BIOS and disable Intel VT-x or AMD-V virtualization extensions.
   • Benefit: Prevents the use of any virtualization features, including Windows Sandbox, eliminating the risk of its abuse.
   • Impact: No effect on standard Windows operations for users not utilizing virtualization.

2. Utilize Windows AppLocker:

   • Method: Configure AppLocker via Group Policy or Local Security Policy to block the execution of WindowsSandbox.exe located in the System32 directory.
   • Benefit: Restricts unauthorized use of Windows Sandbox even if virtualization extensions are enabled, providing an additional layer of security.
   • Implementation: Multiple online tutorials are available to guide users through setting up AppLocker rules.

Steve's Insight:

• Steve Gibson [160:21]: “The absolute best protection... would be to disable a system's virtual machine extensions capabilities at the pre boot firmware level.”
• Leo Laporte [164:10]: “It's Steve's a very generous fella. If you want, you can sign up for his newsletters there, including the weekly mailing of the show notes the day before, but also a very infrequent newsletter which might announce new products like, I don't know, a DNS benchmark pro kind of a thing at some point.”

Conclusion

Episode 1023 of Security Now provides a comprehensive exploration of several critical cybersecurity issues. From the perplexing creation of the inetpub directory in Windows updates to the sophisticated exploitation of Windows Sandbox by malware, Steve Gibson and Leo Laporte offer in-depth analysis and actionable solutions. Additionally, the discussion on SSD data integrity and emerging AI vulnerabilities underscores the evolving landscape of digital security threats. Through engaging dialogue and expert insights, the episode equips listeners with the knowledge to better secure their systems against current and future cyber threats.

Notable Resources:

• Legato Security Advertisement: Mentioned around [07:11]–[12:45], promoting their managed security services.
• Hox Hunt Advertisement: Presented around [105:25]–[109:35], highlighting their gamified phishing prevention solution.
• Spinrite: Referenced throughout as a tool for SSD maintenance and data recovery.
• GRC.com: Steve Gibson’s website for Spinrite, data recovery tools, and additional resources.
• Club TWiT: Advertising their subscription-based community for enhanced content access.

For more detailed information and resources mentioned in this summary, listeners are encouraged to visit GRC.com and explore the show’s official channels on platforms such as YouTube, Twitch, and Discord.