Slashdot Mirror
PowerShell Security Threats Greater Than Ever, Researchers Warn (computerweekly.com)
Microsoft's Windows PowerShell configuration management framework continues to be abused by cyber attackers, according to researchers at Symantec, who have seen a surge in associated threats. From a report on ComputerWeekly: More than 95% of PowerShell scripts analysed by Symantec researchers have been found to be malicious, with 111 threat families using PowerShell. Malicious PowerShell scripts are on the rise, as attackers are using the framework's flexibility to download their payloads, traverse through a compromised network and carry out reconnaissance, according to Candid Wueest, threat researcher at Symantec.
And that's why Microsoft is replacing cmd.exe with PowerShell
FFS who writes this? Of course an anti-virus company is looking for malicious scripts and most of those are going to *wait for it* be malicious. The 5% who aren't are likely abject failures. Symantec isn't knocking on Initech's door asking Jim from the Windows team for his powershell solution to deploy licensed software packages
Good thing MS had the foresight to make sure that non-signed PS scripts aren't executable by default.
Of course... sysadmins generally disable that restriction just like they turn of UAC... MS makes a security measure and people disable it and then complain that MS is so insecure.
But then Linux is insecure in a lot of the same ways... it's only as secure as the weakest link... which is generally the apps running on it.
My eyes reflect the stars and a smile lights up my face.
Maybe this will be the year of Linux on the desktop
wipe the drool from your chin and RTFA
I had the same question as the OP. That line, "More than 95% of PowerShell scripts analysed by Symantec researchers have been found to be malicious," is a direct quote from the article, which provides no context. I'm assuming the author meant 95% of malware that had PowerShell... no even that doesn't make sense.
I don't think the story is credible.
The Daddy casts sleep on the Baby. The Baby resists!
With great PowerShell comes great ResponsibilityShell.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Yeah... RTFA really doesn't help in this case.
That meaningless statistic, is just as meaningless both before and after reading the article.
And nice bit of work from the article author managing to get this particular link in to that paragraph:
href="file:///C:/Users/washford/Documents/4%20Thursday/Microsoft%E2%80%99s%20Windows%20PowerShell%20configuration%20management%20framework"
Shocking conclusion though, apparently executables and scripts downloaded from the internet can be malicious, who would have thought that!?
Hi,
since there's no particular use for it on Joe Doe's pc...
How to switch it *completely* off?
Thanks :)))
Don't give Joe admin access and he'll be fine.
The Daddy casts sleep on the Baby. The Baby resists!
WHen you run powershell as an admin it can do bad things. Who would have thought? I wonder if Linux is vulnerable if someone is logged in as root?
Powershell is not enabled with an execution policy by default. It has to be enabled and most people do not even know what it is so this is no threat? At work we have a GPO that blocks powershell for any non AD admin.
http://saveie6.com/
Powershell has been used to carry out tasks, but we're not talking about PowerShell being exploited here. A pre-existing problem (be it an exploit used to deliver the script, or an ID 10 T problem) would have had to manifest, and you still need to escalate privileges to do something other than a temporary infection or encryption/ransom of the current user account.
Twinstiq, game news
PowerShell isn't a scripting language in the traditional sense -- it's a whole ecosystem that can expose the entire machine if you have the rights, and perform extremely complex stuff on the user's behalf. If you can convince someone to remove the execution protection and run a script you provide, it makes for a very easy malware-distribution utility because it can basically do anything the native OS can, call .NET code directly, grab data from URLs, have JSON conversations, remotely manage other machines on the network and so on. The out of box settings are to only run digitally signed scripts and not allow scripts to be run from remote locations, but it's very possible to just run "Set-ExecutionPolicy Unrestricted" and drop all the protections...then the code you run has all the rights your user account does.
I've mentioned this before, but PowerShell is one of those things that Windows admins are slowly adopting, simply because the alternatives have worked well in the past and are easy to get the basics down in. Those alternatives are disappearing on Windows, so there will be a phase where these kinds of attacks could be very prevalent. It's a little bit like TLS certificates for internal applications -- many admins I know will do the absolute minimum required to stop the browser from showing a certificate error, then run away screaming. And that kind of makes sense -- unless your job is web programming or you're a PKI expert, the details of certificates are very complex and not well documented in an easily digestible form. Like certificates, PowerShell has a really steep learning curve before you can do really useful stuff in it. The basics are easy, but learning to think of every command as returning objects rather than text output you have to play with is a big jump for some people. Makes perfect sense for developers, but less sense for IT people or cross-platform people used to dealing with files and text I/O streams.
You can't windows updates and lots of application installers now use PS scripts to get the work done. If you disable it you break the system. That ship has sailed.
PS is here to stay
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Now more than 95% of PowerShell scripts analysed by Symantec researchers have been found to be malicious, with 111 threat families using PowerShell.
What scripts were they analyzing? I've got a bunch of Powershell scripts, and none of them are malicious.
I don't respond to AC's.
wipe the drool from your chin and RTFA
I had the same question as the OP. That line, "More than 95% of PowerShell scripts analysed by Symantec researchers have been found to be malicious," is a direct quote from the article, which provides no context. I'm assuming the author meant 95% of malware that had PowerShell... no even that doesn't make sense. I don't think the story is credible.
Let me guess. The story is followed up with information on how to purchase Symantec products to secure your Enterprise? Right? Well the way to do that is to buy McAfee instead.
The ironic thing is that every time I try to learn PowerShell I can't get past all the security restrictions it puts on me!
Coder's Stone: The programming language quick ref for iPad
Wait until they find out about buffer overruns in C.
which provides no context.
RTFA:
Malicious PowerShell scripts are mainly used as downloaders
MY GOD THE DUMB IS STRONG HERE
I read TFA. The OP's question--and mine--was "what were Symantec analyzing--where did they get their sample--that 95% of PowerShell scripts were found to be malicious?" If the answer is "known malware" then who cares (and what did the other 5% do?).
Does that make sense? Is the "dumb" still strong?
The Daddy casts sleep on the Baby. The Baby resists!
Just implement Bitlocker in Allow Mode on a system running PSv5 and you'll be much safer.
How about you don't run random code that you don't understand.
Screwing up your system by running someone else's scripts is not unique to Powershell (or MS in general).
Microsoft might take the brunt of the malicious code however, because their software is designed to be easy. Any screwball can stumble their way through adding users or DNS zones in AD's GUI and call themselves a sysadmin. The mental barrier to entry is low, so you'll end up with a higher percentage of idiots running Windows systems. If those same idiots knew how to CLI, they'd be admins for *nix systems, and writing their own code for Powershell on the windows side. But they don't. So they google "How to ... in Powershell," download the first .ps1 file they find and right-click Run as Admin.
This signature is false.
The kinds of vulnerabilities that PowerShell suffers would be suffered by any operating system that has a fairly comprehensive scripting language. The issue simply is if you can automate OS functions like creating, altering or deleting files and other system resources, someone can write a malicious script that, if run even in an non-super user context, can wreak havoc, but if run in a super user or similar higher access context can lead to enormous damage or to compromised systems. There are ways to mitigate this for both Windows and *nix, but more often than not you have to be proactive about it.
The world's burning. Moped Jesus spotted on I50. Details at 11.
This is one of the reasons micro kernels have a much more manageable security model. The problem being microkernels have some performance penalties that, at least in previous generations of CPUs, lead most OS developers to work in monolithic or mixed models. Yes, there are user space device drivers, so there has been a lot of work done to move device drivers a lot further away from Ring 0 and Ring 1, but even this simply makes monolithic kernels even more complex, and complexity is always the enemy of security.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Just run this PowerShell script via pastebin that will solve your problem: http://pastebin.com/QCnQGWLn
Sleep your way to a whiter smile...date a dentist!
Nitpick: OOP access modifiers are (at least in compiled-to-native languages that have real pointers, like C++) advisory, at best. The modifiers are only examined at compile time by the compiler for error checking purposes; there is no runtime restriction.
There is no actual protection; if you can calculate the address of the storage, you can access the data.
-- sigs cause cancer.
Id be amazed if hackers weren't using power-shell!
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.