CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

Researchers Demonstrate How EDR and Antivirus Can Be Weaponized Against Users

admin by admin
December 12, 2022
in Information Security


Dec 12, 2022Ravie LakshmananEndpoint Detection / Data Security

High-severity security vulnerabilities have been disclosed in different endpoint detection and response (EDR) and antivirus (AV) products that could be exploited to turn them into data wipers.

“This wiper runs with the permissions of an unprivileged user yet has the ability to wipe almost any file on a system, including system files, and make a computer completely unbootable,” SafeBreach Labs researcher Or Yair said. “It does all that without implementing code that touches the target files, making it fully undetectable.”

EDR software, by design, are capable of continually scanning a machine for potentially suspicious and malicious files, and taking appropriate action, such as deleting or quarantining them.

The idea, in a nutshell, is to trick vulnerable security products into deleting legitimate files and directories on the system and render the machine inoperable by making use of specially crafted paths.

CyberSecurity

This is achieved by taking advantage of what’s called a junction point (aka soft link), where a directory serves as an alias to another directory on the computer.

Put differently, between the window the EDR software identifies a file as malicious and attempts to delete the file from the system, the attacker uses a junction to point the software towards a different path, like C: drive.

The approach, however, didn’t result in a wipe as EDRs prevented further access to a file after it was flagged as malicious. What’s more, should the rogue file be deleted by the user, the software was clever enough to detect the deletion and stop itself from acting on it.

The ultimate solution arrived in the form of a wiper tool, dubbed Aikido, that triggers the privileged delete by creating a malicious file at a decoy directory and not granting it any permission, causing the EDRs to postpone the delete until next reboot.

Given this new attack interval, all an adversary has to do is delete the directory containing the rogue file, create a junction to point to the target directory to be deleted, and reboot the system.

Successful weaponization of the technique could result in the deletion of system files like drivers, preventing the operating system from booting. It can also be abused to remove all files from administrator user directories.

Out of 11 security products that were tested, six were found vulnerable to the zero-day wiper exploit, prompting the vendors to release updates to address the shortcoming –

“The wiper executes its malicious actions using the most trusted entity on the system — the EDR or AV,” Yair said. “EDRs and AVs do not prevent themselves from deleting files.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

How to use Amazon Verified Permissions for authorization

Next Post

Initiativesofinnovation

Related Posts

Information Security

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

by admin
February 2, 2023
Information Security

AWS achieves ISO 20000-1:2018 certification for 109 services

by admin
February 2, 2023
Information Security

Everything you need to know

by admin
February 2, 2023
Information Security

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

by admin
February 1, 2023
Information Security

How to set up ongoing replication from your third-party secrets manager to AWS Secrets Manager

by admin
February 1, 2023
Next Post

Initiativesofinnovation

Recommended

Initiatetogoapproach

February 2, 2023

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

February 2, 2023

AWS achieves ISO 20000-1:2018 certification for 109 services

February 2, 2023

Everything you need to know

February 2, 2023

Influentialleadership ~ Future of CIO

February 1, 2023

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

February 1, 2023

© 2022 CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 CIO News Hubb All rights reserved.