DEF CON 33 - The Ghost of Internet Explorer in Windows - George Hughey, Rohit Mothe
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 44:19
Internet Explorer may be officially retired, but its security zones technology still underpins modern Windows security mechanisms 1:52. The Map URL to Zone (MUTZ) API, developed in the 1990s, remains critical for security decisions in contemporary applications like Office, Windows Explorer, and antivirus software 8:14.
Key Takeaways:
• Microsoft researchers discovered 12 CVE vulnerabilities in the MUTZ API after external researcher Ben Barnea identified initial canonicalization differences between MUTZ and CreateFile APIs 17:01
• These vulnerabilities allowed attackers to bypass security zones restrictions through path prefixes, hostname misclassification, and canonicalization tricks 20:06
• A 2023 Outlook vulnerability (CVE-2023-23397) exploited by the "Forest Blizzard" threat actor demonstrated the real-world impact of MUTZ flaws, enabling zero-click NTLM hash theft 13:24
• Microsoft addressed the root cause by modifying MUTZ to use the same canonicalization code path as CreateFile, implemented since January 2025 41:03
This research shows how legacy code continues to impact modern security and highlights the importance of collaboration between internal and external security researchers 42:55.
Sources:
- 1:52 Explanation of IE's security zones in modern Windows
- 8:14 How Windows applications use security zones
- 13:24 The 2023 Outlook vulnerability exploited in the wild
- 17:01(https://www.youtube.com/watch?v=8cb_OF_6Ek8&t=
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Good afternoon. This this title of this talk is what is dead may never die. Ladies and gentlemen, Roit and George. >> Thank you. Hello. >> Hi. >> Okay. Hello and welcome to our talk. Uh the title of our talk is what is dead may never die. We're so proud of the title, right? Such a cool, unique, clever name. And as we started making the slides, we realized that there is another talk with the same title at Defcon at the same time. So bad news for some of you. If you're here for that talk, you want to go to that room. But it's level two, right? Bit of a walk. My suggestion, stay for this talk. We have amazing memes, some really high quality presentation. Okay, let's get right to it. What if we told you that all of these modern technologies, browsers, right? latest Office AV, lots of component…