Perimeter

10/2/2017
07:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Weakness In Windows Defender Lets Malware Slip Through Via SMB Shares

CyberArk says the manner in which Defender scans for malicious executables in SMB shares gives attackers an opening.

Researchers at CyberArk Labs have devised what they claimed is a relatively simple way for attackers to sneak known malware past Windows Defender and get it to execute on devices running Windows 10 and Windows 8.1.

The tactic will likely work against other anti-virus tools as well, CyberArk said in an advisory Thursday. But for the moment it has only been tested and shown to work against Windows Defender. As many as 480 million devices with Windows Defender are completely unprotected against attacks that use the approach, the security vendor warned.

The technique that CyberArk has developed exploits a weakness in the process that Windows Defender uses for antivirus scanning of Server Message Block (SMB) shares. The vulnerability gives attackers a way to trick Windows Defender into scanning a different file than the one carrying the malware and that is being executed on a system.

Attackers can execute known malware under the guise of a legitimate file over an SMB server, CyberArk said. "Imagine a situation where you double-click a file and Windows loads that file, but your antivirus scans another file or even scans nothing at all."

In a statement, a Microsoft spokeswoman downplayed the severity of the threat posed by the CyberArk exploit.

“The technique described has limited practical applicability, since it requires an attacker to first gain privileges or control of an internal server," the spokeswoman said. " Should the attacker achieve that prerequisite, Windows Defender Antivirus and Windows Defender Advanced Threat Protection will detect further actions by the attacker.”

Steve Lowing, a product and marketing lead at CyberArk says the problem has to do with the manner in which Windows Defender handles processes loading in SMB shares.

In theory, Windows Defender should "treat the process flow for handling SMB loading exactly like it would for loading a local file on your C drive," he says. The process should not be any different in the sense of opening and reading a file, Lowing says.

But CyberArk's investigation showed that Windows Defender has a different code execution pathway and poor error handling for SMB loaded files. "Through our evaluation and analysis of this weakness, depending on SMB server responses, Defender would indicate success—or, no malware—responses when the file was loaded from an SMB server. "

CyberArk's attack method involved implementing a custom SMB server and creating a "pseudo-server" to differentiate requests being made by Windows Defender and those made by other Windows native processes. Then, by manipulating the responses to those requests, CyberArk said it could get malware to bypass Defender's scanning.

For example when Windows Defender requests a malicious executable file for scanning from the SMB server, the pseudo-server would identify the origin of the request and send it a benign file to scan instead. As an example, CyberArk said it got Windows Defender to detect the Mimikatz post-exploitation tool as a completely different and benign file. Similarly, the SMB server could also be made to block scanning request in a manner that would cause Defender to eventually give up attempting to intercept the file and let it run normally.

"It is fairly easy for someone that wants to leverage this weakness in Defender to implement their own SMB server," Lowing says.

"The most obvious attack vector would be through a phishing campaign where the attacker would either have already compromised an internal server or even the endpoint where the email is being read," he notes. "The end user would need to be tricked into running the file and the file would need to be served up from a nefarious SMB server. An effective attacker would be able to accomplish both of these tasks."

Related content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.