Perimeter

10/2/2017
07:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Weakness In Windows Defender Lets Malware Slip Through Via SMB Shares

CyberArk says the manner in which Defender scans for malicious executables in SMB shares gives attackers an opening.

Researchers at CyberArk Labs have devised what they claimed is a relatively simple way for attackers to sneak known malware past Windows Defender and get it to execute on devices running Windows 10 and Windows 8.1.

The tactic will likely work against other anti-virus tools as well, CyberArk said in an advisory Thursday. But for the moment it has only been tested and shown to work against Windows Defender. As many as 480 million devices with Windows Defender are completely unprotected against attacks that use the approach, the security vendor warned.

The technique that CyberArk has developed exploits a weakness in the process that Windows Defender uses for antivirus scanning of Server Message Block (SMB) shares. The vulnerability gives attackers a way to trick Windows Defender into scanning a different file than the one carrying the malware and that is being executed on a system.

Attackers can execute known malware under the guise of a legitimate file over an SMB server, CyberArk said. "Imagine a situation where you double-click a file and Windows loads that file, but your antivirus scans another file or even scans nothing at all."

In a statement, a Microsoft spokeswoman downplayed the severity of the threat posed by the CyberArk exploit.

“The technique described has limited practical applicability, since it requires an attacker to first gain privileges or control of an internal server," the spokeswoman said. " Should the attacker achieve that prerequisite, Windows Defender Antivirus and Windows Defender Advanced Threat Protection will detect further actions by the attacker.”

Steve Lowing, a product and marketing lead at CyberArk says the problem has to do with the manner in which Windows Defender handles processes loading in SMB shares.

In theory, Windows Defender should "treat the process flow for handling SMB loading exactly like it would for loading a local file on your C drive," he says. The process should not be any different in the sense of opening and reading a file, Lowing says.

But CyberArk's investigation showed that Windows Defender has a different code execution pathway and poor error handling for SMB loaded files. "Through our evaluation and analysis of this weakness, depending on SMB server responses, Defender would indicate success—or, no malware—responses when the file was loaded from an SMB server. "

CyberArk's attack method involved implementing a custom SMB server and creating a "pseudo-server" to differentiate requests being made by Windows Defender and those made by other Windows native processes. Then, by manipulating the responses to those requests, CyberArk said it could get malware to bypass Defender's scanning.

For example when Windows Defender requests a malicious executable file for scanning from the SMB server, the pseudo-server would identify the origin of the request and send it a benign file to scan instead. As an example, CyberArk said it got Windows Defender to detect the Mimikatz post-exploitation tool as a completely different and benign file. Similarly, the SMB server could also be made to block scanning request in a manner that would cause Defender to eventually give up attempting to intercept the file and let it run normally.

"It is fairly easy for someone that wants to leverage this weakness in Defender to implement their own SMB server," Lowing says.

"The most obvious attack vector would be through a phishing campaign where the attacker would either have already compromised an internal server or even the endpoint where the email is being read," he notes. "The end user would need to be tricked into running the file and the file would need to be served up from a nefarious SMB server. An effective attacker would be able to accomplish both of these tasks."

Related content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...