Slashdot Mirror
'Process Doppelganging' Attack Bypasses Most Security Products, Works On All Windows Versions (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: Yesterday, at the Black Hat Europe 2017 security conference in London, two security researchers from cyber-security firm enSilo have described a new code injection technique called "Process Doppelganging." This new attack works on all Windows versions and researchers say it bypasses most of today's major security products. Process Doppelganging is somewhat similar to another technique called "Process Hollowing," but with a twist, as it utilizes the Windows mechanism of NTFS Transactions.
"The goal of the technique is to allow a malware to run arbitrary code (including code that is known to be malicious) in the context of a legitimate process on the target machine," Tal Liberman & Eugene Kogan, the two enSilo researchers who discovered the attack told Bleeping Computer. "Very similar to process hollowing but with a novel twist. The challenge is doing it without using suspicious process and memory operations such as SuspendProcess, NtUnmapViewOfSection. In order to achieve this goal we leverage NTFS transactions. We overwrite a legitimate file in the context of a transaction. We then create a section from the modified file (in the context of the transaction) and create a process out of it. It appears that scanning the file while it's in transaction is not possible by the vendors we checked so far (some even hang) and since we rollback the transaction, our activity leaves no trace behind." The good news is that "there are a lot of technical challenges" in making Process Doppelganging work, and attackers need to know "a lot of undocumented details on process creation." The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows." More research on the attack will be published on the Black Hat website in the following days.
"The goal of the technique is to allow a malware to run arbitrary code (including code that is known to be malicious) in the context of a legitimate process on the target machine," Tal Liberman & Eugene Kogan, the two enSilo researchers who discovered the attack told Bleeping Computer. "Very similar to process hollowing but with a novel twist. The challenge is doing it without using suspicious process and memory operations such as SuspendProcess, NtUnmapViewOfSection. In order to achieve this goal we leverage NTFS transactions. We overwrite a legitimate file in the context of a transaction. We then create a section from the modified file (in the context of the transaction) and create a process out of it. It appears that scanning the file while it's in transaction is not possible by the vendors we checked so far (some even hang) and since we rollback the transaction, our activity leaves no trace behind." The good news is that "there are a lot of technical challenges" in making Process Doppelganging work, and attackers need to know "a lot of undocumented details on process creation." The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows." More research on the attack will be published on the Black Hat website in the following days.
If it's done with multiple processes, is it a Process Doppelgangbang?
...so you run a program on the target machine that uses some API to run some malware undetected. Clever. Computers that run arbitrary software need to be banned. Only approved computers running a small set of governmental approved programs should be permitted.
Windows is better because Linux breaks backward compatibility whenever a penguin takes a shit.
captcha bugged
Nobody mentions the Mac anymore :-(
Slashdot, fix the reply notifications... You won't get away with it...
Why would there be a "sales dive"?
99.9% of buyers don't know, and don't care.
This is why we need alternative file systems on windows. If this were Linux we'd either fix it or change to another file system. Not 'live with inscruity for the remaining days of your life.
Now does this mean we can finally move on to the "post security" era? Please, can we? So much security fatigue...
Anybody can bust into my house with a solid kick, but I don't lose any sleep over it.
Strange things are afoot at the Circle-K.
Not really. But at long last we have a single data point where Window 95 is better than Windows NT.
I don't know if this is funnier written by a human or by a bot. It's like as if Beck trolls /. (Nonsensical words slapped together).
Creating a process from a file that is part of an in-progress transaction is probably not a documented feature of Windows at all. Making such files non-executable until the transaction is completed sounds like it would be a sufficient fix.
Much as I like to brag that Linux folks can fix this sort of thing overnight, it is not really the case that everyone at Microsoft is a knuckle-walking Neanderthal who could not fix this in a week or a month.
Watch some Neanderthal get offended...
Bruce Perens.
Trying to understand this. Basically NTFS Transactions are a deprecated feature, but this amounts to little more than monkeying with the in-RAM read cache of an executable file.
Well great. In order to do that I have to have access to the system at some level in the first place. So this exploit technique is only really viable if you have either an inside job or a leaked password. And it isn't clear to me that you don't need an admin-level access to use that API as well.
Unless I missed something this doesn't seem like that hot an issue.
That's because Macs are designed so anyone can get root with a couple of clicks...
So it works on Windows 3.0?
At last, something fully backwards compatible in Windows.
Slashdot, fix the reply notifications... You won't get away with it...
Well it is Friday evening here, another Windows vulnerability found, it is time for a Drinking Game.
"Spot the shill", you should be able to guess the rules now
Intelligent people use the operating system that lets them get the tasks they want to get done done, rather than engaging in pointless O/S debates.
No. This just another virus. As someone else pointed out, there's no inherent reason you can't detect it the way other viruses are detected. And it doesn't let you gain more privilege. All it does is bypass current virus detection, which presumably will get fixed.
This is amazing. It's the first thing I ever heard of that can work on all versions of windows. They should patent that and make bank.
I laugh at inappropriate times.
Fortunately intelligent people don't post on slashdot.
Democracy is two wolves and a sheep voting on lunch.
Read the summary, the attack canâ(TM)t be detected because the OS doesnâ(TM)t let itself or any other process into a running transaction.
This made senses in the 80s/90s in that you donâ(TM)t want a program unnecessarily holding up or interrupting a disk operation because that would cause corruption, hence why we invented file systems that have a journal.
Custom electronics and digital signage for your business: www.evcircuits.com
The main problem is that Windows doesn't have a proper implementation of Mandatory Access Control that really works. Linux has multiple ones e.g. SELinux and AppArmor.
MAC can prevent this attack since it could prevent the modification of a file by a different process that isn't allowed to do that.
First, pretend that you have a job.
Now, pretend that you have to persuade IT at your job to let you install a filesystem different to the one everyone else in the company is using.
Let us know how it goes.
Il n'y a pas de Planet B.
:-(
One still have to have the rights to open and modify the file, one still have to have the rights to execute the file. It's "just" that one can replace a section of a file one already could modify and execute in a way that malware scanners can't detect.
To me this isn't a huge problem - if security requires malware scanning one have no security. And it is using functionality not commonly used together so a hack that detects the combination and handles it should be relatively easy. But why care?
I'm sure that not instantiating a process from an uncommitted NTfs transaction wouldn't break many legitamate programs.
Only create processes from files that are also not being written to would also work equally as will within the kernel.
Both paths sound like they would ensure that virus software can pick up the dodgy behavior.
A creative attack though.
How about:
Crook: Let's see, here we have a file I want to run and for some reason I have the right to run -> let's go transactional!
NTFS: Ah, a transactional lock! Don't see those too often!
Crook: Modify the file that I for some reason have the right to modify _wïthïn_thá_transáctïon_ HOHOHO!!
NTFS: Okay... Got that.
Scanner: Ah ho a hum, don't see shit... Boring.
Crook: Now let's do the cool thing and run this modified shït!
System: Let's see... Loading a file within a transactional lock? Now I don't like this, I don't like this AT ALL! *plonk*
Crook: OMGWTF?!? I can't run the file :(((
Crook: (releases lock either voluntarily or when killed by system)
NTFS: Ah, a transactional release! Don't see those too often!
Scanner: Still don't see shit... Really boring, should take up macrame or something.
RTFA. The whole point of this exploit is that is undetectable by anti virus software or any other application.
Maybe you should RTFA and THINK.
At the moment, yes, it isn't detected. The user runs a program, the program loads and modifies and runs a different program. The actions of the program in loading and modifying another program CAN BE DETECTED.
Got it?
I disagree, and you might want to think about your claim a bit more too.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Intelligent people that need to use commercial software.
Unless the A/V runs its own rootkit. Then it could probably still track what's going on.
But NASA and in the aircraft industry still have less problems with bugs
How many external attacks are their on the systems? All NASA has to do is not include legacy MacOS binary compatibility to keep spacecraft relatively virus-proof.
The bad news is that the attack "cannot be patched since it exploits fundamental features and the core design of the process loading mechanism in Windows."
Yes, I'd say that qualifies as "bad news". This is ungood, and yet another reason to switch to another OS.
Seriously, after all this time the fucknutz at Microsoft have managed to create a vulnerability that's baked in to every version of Windows, their flagship product?
Just cruising through this digital world at 33 1/3 rpm...
Snippy, motherfucker, snippy.
And it was merely pointing out your posts are useless and unnecessary. No one gives a shit what you post, most times it's nonsense. Now get off the rag and stop being a whiny little bitch.
Please use capital letters next time you feel like insulting someone. I give zero fucks to people who can't do very, very basic English.
You're comparing a specific, critical embedded system intended for operation in space from millions of miles away to be the same as a general purpose desktop operating system sold for free to cheap? Are you fucked in the head? Do you expect heart surgery by your nurse?
Its even stupider than that. The critical embedded system in deep space has about zero malicious hackers analyzing it and attacking it.
And this particular windows flaw would not be a much of a risk on a computer floating in deep space.
Microsoft strongly recommends developers utilize alternative means to achieve your application’s needs. Many scenarios that TxF was developed for can be achieved through simpler and more readily available techniques. Furthermore, TxF may not be available in future versions of Microsoft Windows.
Looks like the future needs to be now.
No, I *could* have mod-bombed you, but you were providing us some fine entertainment by trolling yourself, so why bother.
Il n'y a pas de Planet B.