Slashdot Mirror
New 'Illusion Gap' Attack Bypasses Windows Defender Scans (bleepingcomputer.com)
An anonymous reader writes: Security researchers have discovered a new technique that allows malware to bypass Windows Defender, the standard security software that comes included with all Windows operating systems. The technique -- nicknamed Illusion Gap -- relies on a mixture of both social engineering and the use of a rogue SMB server.
The attack exploits a design choice in how Windows Defender scans files stored on an SMB share before execution. For Illusion Gap to work, the attacker must convince a user to execute a file hosted on a malicious SMB server under his control. This is not as complex as it sounds, as a simple shortcut file is all that's needed.
The problems occur after the user double-clicks this malicious file. By default, Windows will request from the SMB server a copy of the file for the task of creating the process that executes the file, while Windows Defender will request a copy of the file in order to scan it. SMB servers can distinguish between these two requests, and this is a problem because an attacker can configure their malicious SMB server to respond with two different files. The attacker can send a malicious file to the Windows PE Loader, and a benign file to Windows Defender. After Windows Defender scans the clean file and gives the go-ahead, Windows PE Loader will execute the malicious file without Windows Defender realizing they're two different things. Microsoft declined to patch the bug, considering it a "feature request."
The attack exploits a design choice in how Windows Defender scans files stored on an SMB share before execution. For Illusion Gap to work, the attacker must convince a user to execute a file hosted on a malicious SMB server under his control. This is not as complex as it sounds, as a simple shortcut file is all that's needed.
The problems occur after the user double-clicks this malicious file. By default, Windows will request from the SMB server a copy of the file for the task of creating the process that executes the file, while Windows Defender will request a copy of the file in order to scan it. SMB servers can distinguish between these two requests, and this is a problem because an attacker can configure their malicious SMB server to respond with two different files. The attacker can send a malicious file to the Windows PE Loader, and a benign file to Windows Defender. After Windows Defender scans the clean file and gives the go-ahead, Windows PE Loader will execute the malicious file without Windows Defender realizing they're two different things. Microsoft declined to patch the bug, considering it a "feature request."
epic corporate microsoft clusterfuck network
Why send a file once when you can send it twice instead?
n/t
Everyone on windows needs to take this opportunity to transition to a systemd free version of Linux.
Someone should pair this with the article asking if Microsoft has changed their ways because they're embracing Linux.
Decided to give good old Slackware a try. It worked perfectly. I wasn't left with a crippled system either. Some Debian dickheads have decided to not include vital tools like traceroute or nslookup. Kind of difficult to install that package when your route is fucked up. Which brings me to the next point, the route command. It's worked the same way just fine for decades now. In the past you could do "route add default x.x.x.x" not so anymore. The syntax changed for no reason at all.
So in short if you want Linux the way it used to be before these systemd idiots took a shit all over everything then try Slackware.
I might side with MS on this one, though the response doesn't make them look good. The hardest part of this will be getting the user to try and launch the program in the first place. It may be a lot easier just to tailor the malware to evade detection when scanned.
First of all, you can't just make a link the user can click. Chrome and Firefox both block links from the internet that point to the local PC or SMB shares (not sure what IE/Edge do). Even if you get the user to enter the url manually, Chrome and Firefox won't run files but will download them (and tell the virus scanner to scan it), which is a different process from running it directly off the SMB. Chrome even will warn the user if they try to download dangerous file types (such as EXE) from a SMB share.
IE and Edge both open File Explorer to a share if you get the user to type an address in the address bar. But to their credit, if the address is to a file rather than a folder they seem to ignore the entry.
You could potentially find some desktop application that linkifies UNC paths sent to it and get users to click on your malicious path, but I can't imagine any would do so, I can't see how it would be useful. The only one I know of is Lync/Skype for Business, which is of course local network chat, not internet chat.
Windows will alert you if you try to open a dangerous file type off of a SMB share. So the user would have to bypass this dialog.
And of course you're assuming they're running Windows Defender. I would think Windows still would fail to pass the proper binary to any other virus scanner that might have its hooks into Windows, but other scanners could potentially do things like scan the process when it starts to catch the malware.
If you can convince the user to do all this you can probably exploit them some other way just as easily, I'd think.
is most likely what it is.
Good to see that MS is patriotically working the US government to implement NSA requests
It deleted a crack for a game that I had for more than twenty years on my network storage, from inside an archive file.
For Illusion Gap to work, the attacker must convince a user to execute a file hosted on a malicious SMB server under his control.
Ticket Description: Windows Defender is vulnerable to human stupidity
Acceptance Criteria: Show that humans are no longer stupid
Priority: High
Chop chop developers!
We'll make great pets
The technique -- nicknamed Illusion Gap -- relies on a mixture of both social engineering and the use of a rogue SMB server.
This sounds more like a problem with an inside job from an disgruntled worker then a realistic threat.
Ha! My system is set up to use SINGLE clicks.. Check mate, hackers.
Nothing but a venerable TOCTOU.
I just think this requires a bit too much what if's to worry too much about it. I've basically used just Security Essentials and now Defender for years without issues. I know some probably are not so in tune with being aware and identifying security issues. Those in that category need more robust protection. But nothing is 100% and being more educated of the risks does help eliminate some of that risk.
This shows that whoever designed windows defender is brain dead.
Windows defender should scan the actual object being loaded by the kernel, instead of doing stupid things like detecting an execution and then requesting a file with similar name.
I could understand if this was symantec and they said, well there is no API for that.
But this is microsoft. They can create a fucking API just for windows defender.
In any case, if you can get someone to execute a file, how are they not fucked already?
Just use one not detected by windows defender.
Reality is defined by that which there is some type of introduction. Now What ...(?)...
Remember how Windows ME was supposed to be pronounced?
How do other anti-virus programs handle this scenario--some comments were saying this behavior were as a result of defender having to do nothing more than others could do, so this implies the hooks necessary to handle this correctly may not be there. Do others also download a separate copy? Is it that their copy can't be differentiated while the defender copy can? What makes this defender specific?
Yet another reason for ISPs to block SMB traffic at their boundaries.
Bathroom sinks used to have separate taps for hold and cold.
Now we have single-lever controls that combine rate with temperature, by interpolating uniformly between hot and cold. Gasoline pumps do something similar to deliver various octane levels from a small number of distinct feed stocks.
There's no reason, therefore, that a bathroom can't have three different feed stocks: hot (guaranteed no Ebola), cold (guaranteed no Ebola), and fountain of youth (no safety standard mandated).
Of course, you wouldn't want people rinsing their toothbrush with FoY without their consent, seeing as there might just be a tiny health risk.
So, for end-user safety, when you crank the level hard to the left, a red light flashes, there's a momentary buzz, and a few ounces of extra lever resistance which the user must deliberately overcome.
Good design?
You be the judge.
Another approach would be to never allow any byte stream into a page with the execute bit set that hasn't been scanned beforehand. This would be like not piping suspect FoY into the bathroom in the first place. I know, I know. Too dull for words.
Those fanbois who push AI should be all over this.
Talk about machine learning!
Something like this should only happen once, then a fix should be propagated out.
I'm being facetious, of course. AI can't handle a job like that.
It little behooves the best of us to comment on the rest of us.
Actually the Windows Firewall has a similar problem too.
You launch an application, it starts executing and communicating over the network - while the firewall pop-up asking the user for permission to access network is up. However, the application is communicating already!
This is easily visible with Wireshark, for example.
It boggles the mind why Microsoft thought that this is actually an useful feature ...
One wonders how unaware the average W* user is. No Linux user would do that, I doubt if it's an OS X thing. But even assuming the worst for W* users this has to be a small attack vector.
The piece reads well, but convincing someone to execute a remote file seems like a stretch. Of course, if MSFT would address the issue by comparing the two files it would nip this 'feature' in the bud.