Light

Episode #1023 Quiz

Preventing Windows Sandbox Abuse
Date: 2025-04-29 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Windows' April 2025 Patch Tuesday introduced an empty inetpub folder essential for CVE-2025-21204 mitigation, improperly fixed by Microsoft, requiring IIS installation to restore if deleted. This fix enabled a denial-of-service via junction points stopping Windows Updates.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary reason Microsoft requires the inetpub directory to exist on Windows 11 systems after the April 2025 Patch Tuesday update?

Question 1

What is the primary reason Microsoft requires the inetpub directory to exist on Windows 11 systems after the April 2025 Patch Tuesday update?

It is required as part of a security fix to patch CVE-2025-21204 involving privilege elevation via symlink attacks. It serves as a temporary cache folder for Windows Update download files. It is a remnant folder from deprecated Windows 10 components still kept for backward compatibility. It is needed to host Internet Information Services (IIS) by default on all Windows 11 systems.

Question 2: How can malware abuse the Windows Sandbox feature on Windows 10 and 11?

Question 2

How can malware abuse the Windows Sandbox feature on Windows 10 and 11?

By overloading the Sandbox GUI to crash the host system and gain code execution. By secretly launching Sandbox instances under different user accounts without showing any UI, allowing persistent malware execution hidden from Windows Defender. By exploiting a kernel bug to elevate privileges and disable the Sandbox isolation completely. By installing third-party VM software inside Sandbox to run undetectable malware.

Question 3: What mitigation strategies were suggested to prevent Windows Sandbox abuse by unauthorized users?

Question 3

What mitigation strategies were suggested to prevent Windows Sandbox abuse by unauthorized users?

Disabling virtualization extensions (e.g., Intel VT-x) in BIOS to prevent Sandbox functionality, or using AppLocker to block WindowsSandbox.exe and WSB.exe from running. Clearing all user scheduled tasks to prevent Sandbox launching via Task Scheduler. Enabling Windows Defender inside Sandbox via PowerShell to allow malware scanning and detection. Uninstalling IIS to remove the inetpub directory, so Sandbox cannot mount shared folders.

Question 4: According to the episode, what is a key limitation of Windows Sandbox related to OS compromise scenarios?

Question 4

According to the episode, what is a key limitation of Windows Sandbox related to OS compromise scenarios?

The Sandbox runs a completely isolated guest OS image unaffected by host OS state or kernel hooks. Malware inside the Sandbox cannot communicate outside of it, so host compromise doesn't affect Sandbox integrity. Sandbox environments are classified as full virtual machines and therefore cannot be compromised by the host OS. If the host OS is compromised, the Sandbox is inherently compromised because it shares underlying read-only files and memory mappings, including any hooked kernel API functions.

Question 5: What key issue did Kevin Beaumont discover related to the inetpub directory and the Windows servicing stack patch for CVE-2025-21204?

Question 5

What key issue did Kevin Beaumont discover related to the inetpub directory and the Windows servicing stack patch for CVE-2025-21204?

Renaming the inetpub directory disables Windows Defender, exposing the system to malware attacks. Setting inetpub permissions to allow users full control disables Windows Update scheduling but doesn't affect installation. Deleting the inetpub directory causes the Windows servicing stack to corrupt all IIS configuration files permanently. Creating a junction (symlink) from c:\inetpub to c:\windows\system32\notepad causes Windows Update to fail installing future security patches until fixed.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.