Dubbed DoubleAgent, the novel injecting code technique industrial plant on all versions of Microsoft Windows operating systems, starting from Windows XP to the latest free of Windows 10.
What's worse? DoubleAgent exploits a 15-years-old undocumented legitimate characteristic of Windows called "Application Verifier," which cannot endure patched.
Application Verifier is a runtime verification tool that loads DLLs (dynamic link library) into processes for testing purpose, allowing developers apace honor too laid upward programming errors inwards their applications.
Unpatchable Microsoft Application Verifier Exploit
The vulnerability resides inwards how this Application Verifier tool handles DLLs. According to the researchers, every bit business office of the process, DLLs are saltation to the target processes inwards a Windows Registry entry, merely attackers tin supersede the existent DLL amongst a malicious one.
Also Read: Hacker Reveals Easiest Way to Hijack Privileged Windows User Session Without Password
Simply past times creating a Windows Registry cardinal amongst the call same every bit application he wants to hijack, an aggressor tin render his ain custom verifier DLL he would similar to inject into a legitimate procedure of whatsoever application.
Once the custom DLL has been injected, the aggressor tin possess got amount command of the organization too perform malicious actions, such every bit installing backdoors too persistent malware, hijacking the permissions of whatsoever existing trusted process, or fifty-fifty hijacking other users’ sessions.
Here's how the Cybellum researchers say this assail tin work:
"DoubleAgent gives the aggressor the mightiness to inject whatsoever DLL into whatsoever process. The code injection occurs extremely early on during the victim’s procedure boot, giving the aggressor amount command over the procedure too no agency for the procedure to protect itself."
Using DoubleAgent Attack to Take Full Control of Anti-Virus
The squad was able to corrupt the anti-virus app using the DoubleAgent assail too larn the safety software to human activity every bit disk-encrypting ransomware.
Also Read: Microsoft Started Blocking Windows 7/8.1 Updates For PCs Running New Processors
The assail industrial plant on every version of Windows OS from Windows XP to Windows 10 too is difficult to block because the malicious code tin endure re-injected into the targeted legitimate procedure afterward the organization reboots – Thanks to the persistent registry key.
The researchers said almost of the today's safety products on the marketplace are susceptible to the DoubleAgent attacks. Here's the listing of affected safety products:
- Avast (CVE-2017-5567)
- AVG (CVE-2017-5566)
- Avira (CVE-2017-6417)
- Bitdefender (CVE-2017-6186)
- Trend Micro (CVE-2017-5565)
- Comodo
- ESET
- F-Secure
- Kaspersky
- Malwarebytes
- McAfee
- Panda
- Quick Heal
- Norton
After hijacking the anti-virus software, attackers tin also exercise the DoubleAgent assail to disable the safety product, making it blind to malware too cyber attacks, using the safety production every bit a proxy to launch attacks on the local estimator or network, elevating the user privilege grade of all malicious code, hiding malicious traffic or exfiltrate data, or damaging the OS or causing a denial of service.
Note: Cybellum researchers solely focused on anti-virus programs, though the DoubleAgent assail could operate amongst whatsoever application, fifty-fifty Windows operating organization itself.
Many Antiviruses Still Unpatched Even After ninety Days Of Responsible Disclosure
Cybellum said the companionship had reported the DoubleAgent assail to all affected anti-virus vendors to a greater extent than than ninety days ago.
Cybellum researchers possess got been working amongst about anti-virus companies to acre the issue, merely too hence far, solely Malwarebytes too AVG possess got released a patch, spell Trend-Micro has planned to free 1 soon, every bit well.
So, if you lot exercise whatsoever of the iii apps mentioned above, you lot are strongly advised to update it every bit presently every bit possible.
As a mitigation, the researchers complaint that the simplest laid upward for antivirus vendors is to switch from Application Verifier to a newer architecture called Protected Processes.
Protected processes machinery protects anti-malware services against such attacks past times non allowing other apps from injecting unsigned code, merely this machinery has too hence far been implemented solely inwards Windows Defender, which was introduced past times Microsoft inwards Windows 8.1.
Cybellum has also provided a video demonstration of the DoubleAgent attack, showing how they turned an antivirus app into a ransomware that encrypts files until you lot pay up.
The companionship also posted proof-of-concept (PoC) code on GitHub, too 2 blog posts detailing the DoubleAgent attack.
