Microsoft Fixes Critical Flaw in OS Hooking Engine

Microsoft's September Patch Tuesday security update includes a fix for a critical problem reported by enSilo researchers that affects hundreds of Windows applications, including Microsoft's own line of products. In infosec circles, the vulnerability has been affectionally named Captain Hook, based on the name of the presentation given by enSilo researchers at this year's Black Hat USA security conference. Vulnerability resides in little-known Microsoft component The Captain Hook research paper detailed a vulnerability in Detours, a hooking engine created by Microsoft that allows third-party applications to tap into core OS API functions. The research focused on the security problems the Detours vul...