Slashdot Mirror
'Process Doppelganging' Attack Bypasses Most Security Products, Works On All Windows Versions (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: Yesterday, at the Black Hat Europe 2017 security conference in London, two security researchers from cyber-security firm enSilo have described a new code injection technique called "Process Doppelganging." This new attack works on all Windows versions and researchers say it bypasses most of today's major security products. Process Doppelganging is somewhat similar to another technique called "Process Hollowing," but with a twist, as it utilizes the Windows mechanism of NTFS Transactions.
"The goal of the technique is to allow a malware to run arbitrary code (including code that is known to be malicious) in the context of a legitimate process on the target machine," Tal Liberman & Eugene Kogan, the two enSilo researchers who discovered the attack told Bleeping Computer. "Very similar to process hollowing but with a novel twist. The challenge is doing it without using suspicious process and memory operations such as SuspendProcess, NtUnmapViewOfSection. In order to achieve this goal we leverage NTFS transactions. We overwrite a legitimate file in the context of a transaction. We then create a section from the modified file (in the context of the transaction) and create a process out of it. It appears that scanning the file while it's in transaction is not possible by the vendors we checked so far (some even hang) and since we rollback the transaction, our activity leaves no trace behind." The good news is that "there are a lot of technical challenges" in making Process Doppelganging work, and attackers need to know "a lot of undocumented details on process creation." The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows." More research on the attack will be published on the Black Hat website in the following days.
"The goal of the technique is to allow a malware to run arbitrary code (including code that is known to be malicious) in the context of a legitimate process on the target machine," Tal Liberman & Eugene Kogan, the two enSilo researchers who discovered the attack told Bleeping Computer. "Very similar to process hollowing but with a novel twist. The challenge is doing it without using suspicious process and memory operations such as SuspendProcess, NtUnmapViewOfSection. In order to achieve this goal we leverage NTFS transactions. We overwrite a legitimate file in the context of a transaction. We then create a section from the modified file (in the context of the transaction) and create a process out of it. It appears that scanning the file while it's in transaction is not possible by the vendors we checked so far (some even hang) and since we rollback the transaction, our activity leaves no trace behind." The good news is that "there are a lot of technical challenges" in making Process Doppelganging work, and attackers need to know "a lot of undocumented details on process creation." The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows." More research on the attack will be published on the Black Hat website in the following days.
If it's done with multiple processes, is it a Process Doppelgangbang?
Debate in 3..2...1
...so you run a program on the target machine that uses some API to run some malware undetected. Clever. Computers that run arbitrary software need to be banned. Only approved computers running a small set of governmental approved programs should be permitted.
Mmm curry :) I'm hungry.
It means that anyone with the "undocumented knowledge" (ie, Microsoft, NSA) can run whatever they want on a windows machine, and there's nothing to be do about it. Cue Microsoft sales dive in 3..2..1.. Don't feel left out Linux, OS. I'm sure that an "update" would allow you the same "functionality." Big Brother does so love his toys...
This is why we need alternative file systems on windows. If this were Linux we'd either fix it or change to another file system. Not 'live with inscruity for the remaining days of your life.
Now does this mean we can finally move on to the "post security" era? Please, can we? So much security fatigue...
Anybody can bust into my house with a solid kick, but I don't lose any sleep over it.
Strange things are afoot at the Circle-K.
Maybe I could change my surname as Malware, and be know as A Malware forevermore!
Not really. But at long last we have a single data point where Window 95 is better than Windows NT.
Ugh I bet you're the sort of people who gets sniffy if someone says 'the data is' instead of the 'the data are'. Or vice versa.
I don't know if this is funnier written by a human or by a bot. It's like as if Beck trolls /. (Nonsensical words slapped together).
"Unpatchable"? If Microsoft simply disabled the feature very few would even notice...
Creating a process from a file that is part of an in-progress transaction is probably not a documented feature of Windows at all. Making such files non-executable until the transaction is completed sounds like it would be a sufficient fix.
Much as I like to brag that Linux folks can fix this sort of thing overnight, it is not really the case that everyone at Microsoft is a knuckle-walking Neanderthal who could not fix this in a week or a month.
Watch some Neanderthal get offended...
Bruce Perens.
Trying to understand this. Basically NTFS Transactions are a deprecated feature, but this amounts to little more than monkeying with the in-RAM read cache of an executable file.
Well great. In order to do that I have to have access to the system at some level in the first place. So this exploit technique is only really viable if you have either an inside job or a leaked password. And it isn't clear to me that you don't need an admin-level access to use that API as well.
Unless I missed something this doesn't seem like that hot an issue.
Ext2IFS_1_12.exe is an example of it (even CDFS is) & the Windows Installable File System model https://en.wikipedia.org/wiki/Installable_File_System/ proves it for you!
* That executable for Ext2 can be downloaded from many spots online https://duckduckgo.com/?q=Ext2IFS_1_12.exe&t=hf&ia=web/ IF You want Linux filesystems online inside Windows for example!
APK
P.S.=> ... & "there ya go" PLUS Windows, over time, has support for MANY different filesystems (some removed/deprecated like HPFS from OS/2 iirc)... apk
So it works on Windows 3.0?
At last, something fully backwards compatible in Windows.
Slashdot, fix the reply notifications... You won't get away with it...
Well it is Friday evening here, another Windows vulnerability found, it is time for a Drinking Game.
"Spot the shill", you should be able to guess the rules now
Way too many vulnerabilities all across the board lately. Maybe now that Obama is out, all the backdoors from the last 8 years are finally getting exposed and closed.
> Windows is used by people who either don't have a choice, BECAUSE THEY WORK FOR A BIG COMPANY, or are lazy. *nix is used by computer skilled people. Mac is the Unix used by by skilled people who work for big companies.
And when it does, the landscape may forever be changed. Hopefully this will be the straw that breaks microsofts back. My pitch fork has been sharpened!
This is amazing. It's the first thing I ever heard of that can work on all versions of windows. They should patent that and make bank.
I laugh at inappropriate times.
The main problem is that Windows doesn't have a proper implementation of Mandatory Access Control that really works. Linux has multiple ones e.g. SELinux and AppArmor.
MAC can prevent this attack since it could prevent the modification of a file by a different process that isn't allowed to do that.
I'm sure that not instantiating a process from an uncommitted NTfs transaction wouldn't break many legitamate programs.
Only create processes from files that are also not being written to would also work equally as will within the kernel.
Both paths sound like they would ensure that virus software can pick up the dodgy behavior.
A creative attack though.
Oh, and Plan9 FTW!
Apple is jewlery manufacturer.
It is just by sheer accident that there is still a computer well-hidden inside.
Don't worry. It will soon be gone. About the same time, when the screen of the iPhone is replaced by a huge boom-box-sized razor-thin mirror, because that is all that matters. "iPhonez in da hood!"
Even as a boot medium!
Of course the problem is that it's ... btfs.
The fs, where you can't even find out how much of a subvolume quota is used up, without doing essentially a recursive `du` on it.
But hey, you can also ditch Windows, use the glorious ZFS, and waste 1GB of RAM on every TB of storage you have! :P
Neanderthals were intelligent social humanoids.
MS are more like lizard-lamprey-blobfish parasites.
According to msdn.microsoft.com all API used on this attack are only available from Vista OS and up.
Which means XP going down which doesnt support transactional NTFS aren't affected.
True, here's the source: https://msdn.microsoft.com/en-us/library/windows/desktop/bb968806%28v=vs.85%29.aspx
Run-time requirements
TxF is available starting with Windows Vista.
TxF functions are not included in XP Kernel32.dll
I'm constantly amazed about the absolute inability of every OS maker on earth to get even the most basic security features right. I know, I know, there is no such thing as bug-free code. But NASA and in the aircraft industry still have less problems with bugs in critical systems. There is nothing wrong with bugs in non-critical systems, but what contemporary OSes illustrate is just ridiculous. They are programmed in unsafe languages (no memory safety, no safe concurrency, unreadable and hard to maintain) and whenever some complete exploit has been fixed the next one is just at doorstep.
And the reason is very simple: There is 0 accountability of these companies for their criminal negligence. If anybody can pawn your OS with a one-liner or by using "root" with no password, you'd expect someone at the company who produces the OS to get into troubles, maybe even go to prison. Yet nothing happens. Imagine an engineer who suffers no consequences when the bridge he's calculated breaks down! "Software engineers" my ass.
The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows."
Yes, I'd say that qualifies as "bad news". This is ungood, and yet another reason to switch to another OS.
Seriously, after all this time the fucknutz at Microsoft have managed to create a vulnerability that's baked in to every version of Windows, their flagship product?
Just cruising through this digital world at 33 1/3 rpm...
See subject: I never said anything about work/job. I only point out fact that Windows IFS allows diff. filesystems.
You're clearly unable to show otherwise.
* Additionally: Obviously (unlike YOU 'wageslave') you don't realize I haven't had to work for ANYONE in a decade++ & my monies work for ME (not the other way around - I'm past that, you're not)).
HOWEVER - As far as that is concerned? I almost GUARANTEE you've never done as much as I have in this field NOR will you ever!
APK
P.S.=> Trolling me is a waste of your time ZontarTheMindless - you name yourself rather aptly - after all, I always make YOU (& "your kind", fake names for fake lives) EAT YOUR WORDS -> https://slashdot.org/comments.pl?sid=5033597&cid=46760611/ & yes you blow all your "downmodpoints" on downmodbombing me (which I RUN YOU DRY OF easily by reposting (NO LIMITS on my posting unlike most ac's)) https://slashdot.org/comments.pl?sid=10878741&cid=54858603/ + https://slashdot.org/comments.pl?sid=10878741&cid=54835069/ ... apk
according to the discoveries in this research. If you use Windows, anyone who wants to can get inside your computer.
See subject: However, what stops "YOUR KIND" (the UNIDENTIFIABLE trolling worm)? A lack of SKILL + WILL to do so.
* I merely pointed out fact that Windows DOES support multiple filesystems & CAN SUPPORT MORE via IFS!
APK
P.S.=> Truer words were NEVER spoken on /. (& you KNOW it, lol) - me, by way of comparison? I do stuff our /. peers even LIKE & USE https://slashdot.org/comments.pl?sid=11420419&cid=55704671/ - "your kind" can't & doesn't! apk
Snippy, motherfucker, snippy.
Please use capital letters next time you feel like insulting someone. I give zero fucks to people who can't do very, very basic English.
See subject: Talking w/ your mouth full isn't polite as you EAT YOUR WORDS https://slashdot.org/comments.pl?sid=10557875&cid=54347839/ I made you eat!
(... & anyone can read what you said before it laughing @ you afterwards - I surely did!).
* You make it SO easy to laugh @ you it's not even funny anymore!
STUPID - learn to read - the guy I replied to said Windows ought to allow other filesystems & guess what? IT DOES, you dumbass!
APK
P.S.=> You'll die of malnutrition vs. me Brockmire as EATING YOUR WORDS != Good nutrition, lol... apk
Microsoft strongly recommends developers utilize alternative means to achieve your application’s needs. Many scenarios that TxF was developed for can be achieved through simpler and more readily available techniques. Furthermore, TxF may not be available in future versions of Microsoft Windows.
Looks like the future needs to be now.