Slashdot Mirror

← Back to Stories (view on slashdot.org)

Drive-By Exploits Pushing Ransomware Now Able To Bypass Microsoft EMET (arstechnica.com)

Posted by BeauHD on from the back-and-forth dept.

An anonymous reader writes from a report via Ars Technica: Ars Technica reports that drive-by attacks that install the TeslaCrypt crypto ransomware are now able to bypass Microsoft's Enhanced Mitigation Experience Toolkit (EMET), which is designed to block entire classes of Windows-based exploits. The EMET-evading attacks are included in Angler, a toolkit for sale online that provides ready-to-use exploits that can be stitched into compromised websites. Researchers from FireEye published a blog post Monday that says the new Angler attacks are significant because they're the first exploits found in the wild that effectively pierce the mitigations. The exploits' code is based on the Adobe Flash and Microsoft Silverlight browser plugins that bypass data execution prevention, a protection that prevents computers from running data loaded into memory. The new Angler exploits rely on techniques other than Data Execution Prevention (DEP) that are harder to detect and contain fewer limitations. FireEye researchers have observed the exploits working only on Windows 7 and not on Windows 10, which is more resistant to exploits. They also only work when targeted computers have either Flash or Silverlight installed. Microsoft created EMET to largely block entire classes of memory-based software exploits that had existed for decades. Now, Angler developers have struck back with techniques that can undo some of those protections. Recently, the TeslaCrypt ransomware makers closed down shop and released a master key and an apology.

52 comments

  1. Huh by Anonymous Coward · · Score: -1

    "...have observed the exploits working only on Windows 7 and not on Windows 10, which is more resistant to exploits."

    Haha.. haha.. AHAHAHAHAHA... Windows 10 is one big exploit itself!

    1. Re:Huh by Anonymous Coward · · Score: 0

      and not on Windows 10, which is more resistant to exploits."

      Which the FireEye didn't actually say.. Nice summary, nice summary, lets be friends.

  2. My question by TheDarkener · · Score: 2, Insightful

    Why does Adobe Flash and Microsoft Silverlight browser plugins bypass data execution prevention?

    --
    It is pitch black. You are likely to be eaten by a grue.
    1. Re:My question by Anonymous Coward · · Score: 0, Troll

      Why does Adobe Flash and Microsoft Silverlight browser plugins bypass data execution prevention?

      Because... Microsoft....

      The real answer is Bill Gates is such a visionary that he rejected commonly held principle of least privilege to run a given task, and instead went with root with masks. Yep, real genius, that guy.

    2. Re:My question by Anonymous Coward · · Score: -1

      Why does Adobe Flash and Microsoft Silverlight browser plugins bypass data execution prevention?

      To really explain this in-depth would require going over a lot of low-level details concerning x86 processor architecture, including the difference between a von Neumann architecture in which the data and code use the same memory pipeline, versus the Harvard architecture in which these are completely separate inputs to the CPU. This in turn affects the way memory must be protected, when and how data can be executed as code, and the like. In summary, in all likelihood after considering all possible factors, the most meaningful and reasonable explanation is that you're a stupid nigger.

    3. Re:My question by Anonymous Coward · · Score: 1

      Get back to TempleOS,Terry.

    4. Re:My question by Dog-Cow · · Score: 4, Informative

      Anything with a JIT needs to bypass DEP.

    5. Re:My question by Anonymous Coward · · Score: 0

      That is not an answer at all, and is so dated that it's completely irrelevant info anyway.

    6. Re:My question by DigiShaman · · Score: 3

      And therein lies the problem! The entire paradigm of running JIT code from a web browser is uber fucking stupid! JAVA, FLASH, SILVERLIGHT, it's not platform insomuch as the philosophy of taking code from the internet, and executing it in a way that's not sandboxed.

      --
      Life is not for the lazy.
    7. Re:My question by Anonymous Coward · · Score: 1

      Good job. You have now described the problem. And just like many others, you have done only that. As your next step, please devise and describe a feasible solution. That would actually be helpful.

      I do not know what a feasible solution looks like. Then again, I do not run around pointing out a well known problem to everyone all the time, either.

    8. Re:My question by Anonymous Coward · · Score: 0

      Enable EMET system wide DEP OptOut in the latest Futuremark test which uses Java and you got a complete system crash at test load time for some systems with Windows 10. EMET DEP has been a precarious child from the beginning, as it changes the way Windows DEP protection works across processes.

    9. Re:My question by DigiShaman · · Score: 1

      Solution is to *NOT* use JIT code in a NON-SANDBOXED environment. If you must, run native apps.

      --
      Life is not for the lazy.
    10. Re:My question by Anonymous Coward · · Score: 0

      No, that's completely wrong. VirtualProtect() can be used to mark regions as executable regardless of DEP setting, and this is the preferred behavior for any competently written JIT, because you know exactly what sections you need marked as executable.

  3. Vendors can bypass DEP? by Anonymous Coward · · Score: -1

    This is more concerning than the actual exploit. The fact its allowed at all means its only a matter of time before its completely exploitable n the wild and the implementation is effectively FUBAR'd thereafter. Corporate machines - maybe not so much a concern as Silverlight+Flash can be blocked. Home machines - get ready for a flood of tech support calls from the family.

    On a related note - where can I signup for said access to bypass DEP? For educational purposes only I promise!

    1. Re:Vendors can bypass DEP? by Anonymous Coward · · Score: 1

      You can do it at link time with this: https://msdn.microsoft.com/en-... Or by setting the proper AppCompatFlags. Or by calling SetProcessDEPPolicy. Or half a dozen other ways documented on MSDN and technet.

    2. Re:Vendors can bypass DEP? by Anonymous Coward · · Score: 0

      And you can allocate executable blocks with VirtualAlloc and change protection settings using VirtualProtect. The reasons that it's possible to bypass DEP in various ways fall broadly in two categories: backward compatibility and scripting.
      1. Backward compatibility
      DEP was introduced in Windows XP and didn't exist before then. Even in Windows XP it isn't turned on by default for most processes. A lot of software has been written that executes data. A few common examples:
      - Certain compilers (including GCC) allocate trampolines on the stack for certain operations. Trampolines are essentially bits of executable code that do a bit of bookkeeping and then jump to the actual function. An example use case is where you take a pointer to a nested function. Nested functions have access to locals from the function they're nested in, so they need to know where to find them. A common, but dangerous, way to do this is to allocate a trampoline on the stack that fixes the stack pointer so the trampoline sees the correct locals when it's called. GCC later ‘fixed’ this IIRC by marking the page with the trampoline executable, which is the worst solution imaginable since it effectively disables DEP for at least 4 kB of stack. It would have been better to either disable trampolines and the language features that require them (after all, you cannot safely use them now anyway) or to allocate them from a special heap.
      - Certain popular libraries (including ATL) generate thunks, bits of executable code that convert input parameters into a form in which they can be consumed by the actual function. An example use case is where a callback is called by the operating system using a handle, but the actual function needs a pointer to a C++ object. So for example in ATL this is used to convert a window handle into a pointer to the object that implements the window's behaviour for use as a this pointer. In principle this can be fixed by allocating thunks from a special heap, but not all software has been recompiled and / or relinked with a newer library that does that.
      - And then there are old scripting engines and the software that uses them. Next section.
      2. Scripting
      Scripting engines often aren't completely interpreted, because that makes them slow. Instead they translate the scripting code they want to execute, for example JavaScript or Java / .Net byte code into native code. In addition even pure interpreters often still need to generate code, like thunks when the interpreted code needs to interface with the native environment, for example when a callback in interpreted code needs to be called from native code.
      Nowadays it's possible to allocate this executable code from a special heap with modified permissions so code can execute even with DEP for the process as a whole turned on. It is an extra bit of executable memory though and care must be taken to avoid making it easy for attackers to exploit that.
      And of course, older scripting engines were written before DEP was a thing and they don't know that they need to jump through the hoops and therefore don't work if DEP is enabled.

  4. Daily backups, never pay a red cent by Anonymous Coward · · Score: 0, Insightful

    Make daily back-ups. Never pay a red cent to that filth. It'll go away if we stop paying them. Maybe we should make it illegal to pay them, as well as for them to do what they do.

    1. Re:Daily backups, never pay a red cent by toejam13 · · Score: 4, Insightful

      That works for ransomware programs that simply encrypt and then immediately extort, but there are others that will silently encrypt for weeks before issuing a ransom. So unless you validate your backups with another clean computer, you might not know.

    2. Re:Daily backups, never pay a red cent by Anonymous Coward · · Score: 0

      That works for ransomware programs that simply encrypt and then immediately extort, but there are others that will silently encrypt for weeks before issuing a ransom. So unless you validate your backups with another clean computer, you might not know.

      Might not know if your data is secure? Yes it's certain. You're another satisfied Microsoft customer!

    3. Re:Daily backups, never pay a red cent by Anonymous Coward · · Score: 0

      I'm kinda surprised the US government hasn't started a massive propaganda campaign about "ransomware funds terrorism." Considering government bodies have paid the damn ransom, I guess they have to keep their options open.

    4. Re:Daily backups, never pay a red cent by Anonymous Coward · · Score: 0

      Fake support scammers are catching on to this.
      They are beginning to ask for gift card codes for iTunes now instead of Credit Card numbers.

    5. Re:Daily backups, never pay a red cent by Anonymous Coward · · Score: 0

      They are waiting to get them for tax evasion.

  5. Well, DUH! by jcr · · Score: 0

    The exploits' code is based on the Adobe Flash and Microsoft Silverlight browser plugins

    So don't run crapware in your browser, and you're all set.

    -jcr

    --
    The only title of honor that a tyrant can grant is "Enemy of the State."
    1. Re: Well, DUH! by Anonymous Coward · · Score: -1

      Yeah

      -notjcr

    2. Re: Well, DUH! by Anonymous Coward · · Score: -1

      What he said

      -jcpenny

    3. Re: Well, DUH! by Anonymous Coward · · Score: -1

      What I said.

      -jcsuper*

  6. Well cancelled the netflix awhile back by Crashmarik · · Score: 1

    That was my one reason for Silverlight.
    Flash disabled for awhile now just too damn dangerous.

  7. Well if pop up upgrades don't succeed by Anonymous Coward · · Score: 0

    Create a ransomware to force upgrade/make some pocket money.

  8. I am shocked!!! by mspohr · · Score: 0, Flamebait

    OMG! I just can't believe it! Does this mean that Windows is not secure???
    What should I do???!!?!?

    --
    I don't read your sig. Why are you reading mine?
    1. Re:I am shocked!!! by Opportunist · · Score: 2, Insightful

      Hey, don't worry, Windows is as secure as ever!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  9. How Convenient! by Pant$H8r · · Score: 0

    If this doesn't get you to upgrade to Windows 10, nothing will!

    1. Re:How Convenient! by Opportunist · · Score: 1

      At this point I'm honestly waiting for MS to push the Win10 update by means of a drive-by infecting trojan.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  10. Re:Well, DUH! Nigger by Anonymous Coward · · Score: -1

    The exploits' code is based on the Adobe Flash and Microsoft Silverlight browser plugins

    So don't run crapware in your browser, and you're all set.

    -jcr

    If you didn't redundantly add "-jcr" to the bottom of your posts - as if we can't see your username at the top - do you KNOW where we would BE?! We'd all be doomed. DOOMED!

  11. Impossible by melting_clock · · Score: 0

    A Microsoft product vulnerable to exploits? That just can't true... Putting aside the sarcasm for a moment, this really should not come as a surprised to anyone. MS products are constantly targeted because MS makes them easy targets and their latest OS version has spyware and adware built in.

    Anyone foolish enough to trust MS to fight against malware, when MS are pushing their own spyware/adware in Windows 10, is crazy and deserves whatever they get.

    1. Re:Impossible by Anonymous Coward · · Score: 2, Informative

      These exploits work on some unpatched Windows 7 which was released in 2009. Windows 10 is not vulnerable to them at all. At least RTFM and get a clue before making blanket statements that make you sound like you don't know what you're talking about.

  12. MS can fix this easily by lord+merlin · · Score: 2

    Microsoft has lots of money. Why don't they just actively buy these exploits as they hit the market (through an 'agent' if they must), reverse engineer them, update EMET & issue a patch that closes the flaw, and move on, long before anyone is hacked ???

    1. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      Seriously? +1 for "enter the market for buying exploits from blackhats"? On a par with a drugs policy that says "the goverment should just buy all the drugs at street prices" Pathetic.

    2. Re: MS can fix this easily by Opportunist · · Score: 1

      False analogy. You cannot simply up the production of 0day exploits when you see an increase in demand, unlike drugs.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      Um, yes, yes you can. An increased financial incentive, and much more importantly a guarenteed and stable one, means there will be a lot more people spending a lot more time looking for exploits and producing exploit code. This means more 0 days.

      These things don't just spontaneously pop into existence from the ether, or do you think that they just appear at a random predetermined rate?

    4. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      It's not a false analogy. More people would join the search for exploits.

    5. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      Not just more people, but existing people who already find bugs that turn out to be exploitable are going to see this as an easy revenue stream. The choice becomes:

      1. Report the problem and maybe it gets acknowledged in 6 months or 3 years time, most likely its buried inside some non-descriptive update and you'll be lucky to get credit.
      2. Construct some 0day exploit code from the bug, sell it on to the vendor with a clean conscious, get a lot of money and also 1.

      Once you're doing 2., there's a new temptation that since you've gone that far, with no extra effort you might as well do 0. and also start selling your exploit code on the black market as well for even more money.

    6. Re: MS can fix this easily by swb · · Score: 1

      On a par with a drugs policy that says "the goverment should just buy all the drugs at street prices" Pathetic.

      I've read more than once that in the mid 1970s several warlords in the Golden Triangle offered to sell the US government their entire opium production.

      And I think it's been suggested as a counter-insurgency tactic in Afghanistan. Rather than spending even more to convince local farmers to grow lower-value cash crops and an eradication by force campaign, simply corner the market and buy up the supply.

      I'm sure there are problems, both in terms of academic economics and unintended consequences, but it's an interesting idea. And I think that it's never been tried tells me something about the other motivations of drugs policy that have nothing to do with inhibiting drug use.

      (Don't get me wrong, I think that prohibitionist drugs policy is broken and nonworkable, but cornering the market on supply is an intriguing idea that's dismissed too easily.)

    7. Re: MS can fix this easily by gtall · · Score: 1

      And create a growth market for the supply of opium. If you are guaranteed a price which makes it worth your while to grow opium, then you have every incentive to maximize your acreage. And there's nothing stopping you from siphoning some off for the local warlords you need to keep happy for the privilege of growing opium. To stop the siphoning means ramping up enforcement. If you, as an opium grower, is faced with enforcement from the U.S. or local governments, that still will fail to compete against death from your friendly neighborhood warlord.

      The fun wouldn't stop there though. A guaranteed money supply will encourage the local authorities to look the other way and siphon a bit off for themselves.

      I find your idea not very intriguing, but then it wouldn't be the first bright idea run into the shoals by human behavior.

    8. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      So the solution is to hire killers to find these ass hats and give them hot lead poisoning. That was the solution to the Heroin growers.
      NEVER PAY the ransom!

    9. Re: MS can fix this easily by Anonymous Coward · · Score: 0

      And that's worked so well.

  13. Re:Well, DUH! Nigger by jcr · · Score: -1, Troll

    I do that so that someday you'll drop dead from an extreme fit of pique.

    -jcr

    --
    The only title of honor that a tyrant can grant is "Enemy of the State."
  14. The internet isn't very useful by Anonymous Coward · · Score: 0

    It isn't suitable for anything serious, it's a constant battle that will never end.
    I'm pretty sure that "The Clapper" was a more beneficial invention than the internet.(saw one on clearance the other day, haha)
    It's useful to download some files or documents and send some email, but that's about it, connect - get your stuff -then disconnect. Other than that it's a sad joke but it is amusing to sit back and watch the never ending failures.

  15. MS could fix this easily but it will not by Anonymous Coward · · Score: -1

    Problem is that MS is not interested in improving its operating systems anymore. Their only department which gets funding is Windows10-malware distribution center. Likely they will even use these exploits themselves to bypass the pesky users and admins, who have disable automatic updates or have installed GWX control panel to fight against forceful Windows10 installations.

  16. "EMET evading" by Anonymous Coward · · Score: 0

    EMET isn't a technology, its a package containing a number of security enhancing techniques (none invented by Microsoft), so "bypasses EMET" at best is uninformative, at worse makes little sense.

  17. Why is this news? by Anonymous Coward · · Score: 0

    This DEP bypass has been known about for over 10 years. I guess people in security theatre land love their false sense.

    1. Re:Why is this news? by Opportunist · · Score: 1

      Hey, WE have been telling people for at least 10 years now that DEP is a problem. It just takes the idiots in management roughly a decade to get their head out of their ass (or off the coke table) and realize there is a problem. Currently we're waiting for them to notice that social engineering could be a problem and that we should implement steps to ensure that mails that allegedly come from management really do, but I don't hold my breath for this to arrive with them.

      Like every other problem on this planet, it has to go through the 9 steps of management problem treatment:

      1. Ignoring it, hoping it will simply go away.
      2. Realizing, after some considerable damage, that it does not.
      3. Designing mitigation strategies that continue to ignore the problem, with the core requirement of those strategies being that they make them seem like they do something and not cost anything.
      4. Realizing that the problem still doesn't go away despite their "strategic decisions".
      5. Designing other mitigation strategies that shift the blame on the staff.
      6. Realizing that it's not human error after firing key personnel, hiring new duds and finding out that this lowers productivity considerably because the new guys lack the experience with the company's internal workflows.
      7. Asking their IT security staff.
      8. Not liking ITSEC's answer and ignoring it.
      9. Demanding better laws from government.

      10 should be that they find out that laws only apply within the borders of their own country and that people in countries that have real problems and don't give a fuck about "cyber crime" are pretty safe from anything, but usually it doesn't get that far before a new problem arrives at the horizon. And no, I have no idea what 11 could be.

      It never happened.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Why is this news? by Anonymous Coward · · Score: 0

      Since I'm the same AC responsible for both posts you replied to, I'd like to say I can't argue with this one! Unfortunately, due to the limited political lifecycle, we find that we're lucky if it gets as far as 7. down that list before the whole thing resets and starts again.

      At a guess, 11 might be "closing electronic borders" to countries that don't enforce "cyber crime" or have treaties in place, although by the time 11. comes the rule of nation states will officially at an end and we'll have long since degenerated to corporate serfdoms.