Slashdot Mirror
Drive-By Exploits Pushing Ransomware Now Able To Bypass Microsoft EMET (arstechnica.com)
An anonymous reader writes from a report via Ars Technica: Ars Technica reports that drive-by attacks that install the TeslaCrypt crypto ransomware are now able to bypass Microsoft's Enhanced Mitigation Experience Toolkit (EMET), which is designed to block entire classes of Windows-based exploits. The EMET-evading attacks are included in Angler, a toolkit for sale online that provides ready-to-use exploits that can be stitched into compromised websites. Researchers from FireEye published a blog post Monday that says the new Angler attacks are significant because they're the first exploits found in the wild that effectively pierce the mitigations. The exploits' code is based on the Adobe Flash and Microsoft Silverlight browser plugins that bypass data execution prevention, a protection that prevents computers from running data loaded into memory. The new Angler exploits rely on techniques other than Data Execution Prevention (DEP) that are harder to detect and contain fewer limitations. FireEye researchers have observed the exploits working only on Windows 7 and not on Windows 10, which is more resistant to exploits. They also only work when targeted computers have either Flash or Silverlight installed. Microsoft created EMET to largely block entire classes of memory-based software exploits that had existed for decades. Now, Angler developers have struck back with techniques that can undo some of those protections. Recently, the TeslaCrypt ransomware makers closed down shop and released a master key and an apology.
Why does Adobe Flash and Microsoft Silverlight browser plugins bypass data execution prevention?
It is pitch black. You are likely to be eaten by a grue.
That works for ransomware programs that simply encrypt and then immediately extort, but there are others that will silently encrypt for weeks before issuing a ransom. So unless you validate your backups with another clean computer, you might not know.
That was my one reason for Silverlight.
Flash disabled for awhile now just too damn dangerous.
Microsoft has lots of money. Why don't they just actively buy these exploits as they hit the market (through an 'agent' if they must), reverse engineer them, update EMET & issue a patch that closes the flaw, and move on, long before anyone is hacked ???
You can do it at link time with this: https://msdn.microsoft.com/en-... Or by setting the proper AppCompatFlags. Or by calling SetProcessDEPPolicy. Or half a dozen other ways documented on MSDN and technet.
These exploits work on some unpatched Windows 7 which was released in 2009. Windows 10 is not vulnerable to them at all. At least RTFM and get a clue before making blanket statements that make you sound like you don't know what you're talking about.
Hey, don't worry, Windows is as secure as ever!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
At this point I'm honestly waiting for MS to push the Win10 update by means of a drive-by infecting trojan.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Hey, WE have been telling people for at least 10 years now that DEP is a problem. It just takes the idiots in management roughly a decade to get their head out of their ass (or off the coke table) and realize there is a problem. Currently we're waiting for them to notice that social engineering could be a problem and that we should implement steps to ensure that mails that allegedly come from management really do, but I don't hold my breath for this to arrive with them.
Like every other problem on this planet, it has to go through the 9 steps of management problem treatment:
1. Ignoring it, hoping it will simply go away.
2. Realizing, after some considerable damage, that it does not.
3. Designing mitigation strategies that continue to ignore the problem, with the core requirement of those strategies being that they make them seem like they do something and not cost anything.
4. Realizing that the problem still doesn't go away despite their "strategic decisions".
5. Designing other mitigation strategies that shift the blame on the staff.
6. Realizing that it's not human error after firing key personnel, hiring new duds and finding out that this lowers productivity considerably because the new guys lack the experience with the company's internal workflows.
7. Asking their IT security staff.
8. Not liking ITSEC's answer and ignoring it.
9. Demanding better laws from government.
10 should be that they find out that laws only apply within the borders of their own country and that people in countries that have real problems and don't give a fuck about "cyber crime" are pretty safe from anything, but usually it doesn't get that far before a new problem arrives at the horizon. And no, I have no idea what 11 could be.
It never happened.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.