Connect with us

Hi, what are you looking for?



Microsoft Releases Attack Surface Analyzer 2.0

Microsoft has rewritten its Attack Surface Analyzer tool to take advantage of modern, cross-platform technologies, the company announced this week. 

Microsoft has rewritten its Attack Surface Analyzer tool to take advantage of modern, cross-platform technologies, the company announced this week. 

The initial Attack Surface Analyzer 1.0 was released in 2012, designed to help software developers and IT professionals identify modifications that occur in the Windows operating systems during application installations. 

The new iteration of the tool, Attack Surface Analyzer 2.0, was built using .NET Core and can now be used on Windows, Linux, and macOS, and has been released as open source on GitHub.

With the help of Attack Surface Analyzer 2.0, developers can identify potential security risks that changes to the operating system’s security configuration may introduce. The tool analyzes the attack surface of a target system and reports on potential vulnerabilities introduced during app installation. 

For that, the tool monitors for modifications made to the file system, user accounts, system services, network ports (listeners), system certificate stores, and registry (only on Windows). 

“This tool can play an important role in ensuring that the software you develop or deploy doesn’t adversely affect the operating system security configuration by allowing you to scan for specific types of changes,” Microsoft explains

In the results it delivers after performing the comparison analysis, Attack Surface Analyzer 2.0 highlights relevant changes. Furthermore, the tool allows for these results to be easily viewed or exported.

The updated tool includes both Electron and command line interface options and writes the results for the command line option to a local HTML or JSON file, thus supporting inclusion in automated toolchains.

Advertisement. Scroll to continue reading.

Microsoft says it is aiming at adding more features to the tool, including code signing info, monitoring of drivers and firewall settings, live monitoring of network traffic and registry, and redistributable installations. 

Related: Security Shifts Left to be Part of Software Development Best Practice: Report

Related: How the Secure Development Lifecycle Can Help Protect IIoT Deployments

Related: Google Launches “Asylo” Framework for Confidential Computing

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.