| Protected Processes » |
New attack bypasses virtually all AV protection
I have been receiving many questions due to recently published vulnerabilities described in my earlier research on "TOCTOU with NT System Service Hooking". So I decided to clarify the matter.
The research describes TOCTOU (Time-Of-Check-to-Time-Of-Use) issues applicable to hooking of Windows system services. The hooking is typical approach used by various security products around. With the research I have published a sample exploit which does not target any particular product.
What is severity?
The vulnerability allows bypassing certain security restrictions enforced by 3d security software, such as anti-viruses, host intrusion preventions, firewalls and etc. The issue renders the products ineffective. However, it doesn't introduce additional threats, such as privilege escalation and so on.
Who is affected?
Many 3d party security products running 32-bit Windows platforms use hooking of Windows Services. To a certain extent all such products are vulnerable.
How easy it to exploit?
As was demonstrated in my research the exploit could be simple and stable particularly on multi-CPU/Core machines.
How to fix it?
In most of cases the issue cannot be properly fixed without removing system service hooking. The hooking should be replaced by device filtering, object and registry callbacks, various filter APIs and other means provided by Windows core. Virtually it means the affected security products should be partially re-designed. It takes quite a bit of time and cannot be done over night. So we may oversee vendors quickly claiming a fix but it likely would be just a workaround for particular attack vector, not a proper fix.