Unpatchable 'Doubleagent' Assault Tin Halt Hijack All Windows Versions — Fifty-Fifty Your Antivirus!

Influenza A virus subtype H5N1 squad of safety researchers from Cybellum, an Israeli zero-day prevention firm, has discovered a novel Windows vulnerability that could let hackers to possess got amount command of your computer.

Dubbed DoubleAgent, the novel injecting code technique plant on all versions of Microsoft Windows operating systems, starting from Windows XP to the latest unloose of Windows 10.

What's worse? DoubleAgent exploits a 15-years-old undocumented legitimate characteristic of Windows called "Application Verifier," which cannot hold upwards patched.

Application Verifier is a runtime verification tool that loads DLLs (dynamic link library) into processes for testing purpose, allowing developers rapidly respect as well as laid upwards programming errors inwards their applications.

Unpatchable Microsoft Application Verifier Exploit

The vulnerability resides inwards how this Application Verifier tool handles DLLs. According to the researchers, equally usage of the process, DLLs are jump to the target processes inwards a Windows Registry entry, only attackers tin supercede the existent DLL amongst a malicious one.

Also Read: Hacker Reveals Easiest Way to Hijack Privileged Windows User Session Without Password

Simply past times creating a Windows Registry fundamental amongst the call same equally application he wants to hijack, an aggressor tin furnish his ain custom verifier DLL he would similar to inject into a legitimate procedure of whatsoever application.

Once the custom DLL has been injected, the aggressor tin possess got amount command of the organization as well as perform malicious actions, such equally installing backdoors as well as persistent malware, hijacking the permissions of whatsoever existing trusted process, or fifty-fifty hijacking other users’ sessions.

Here's how the Cybellum researchers say this assault tin work:

"DoubleAgent gives the aggressor the mightiness to inject whatsoever DLL into whatsoever process. The code injection occurs extremely early on during the victim’s procedure boot, giving the aggressor amount command over the procedure as well as no agency for the procedure to protect itself."

Using DoubleAgent Attack to Take Full Control of Anti-Virus

In guild to demonstrate the DoubleAgent attack, the squad hijacked anti-virus applications -- which is the master copy defence on systems to forestall whatsoever malware from running -- using their technique as well as plow them into malware.

The squad was able to corrupt the anti-virus app using the DoubleAgent assault as well as larn the safety software to human activity equally disk-encrypting ransomware.

Also Read: Microsoft Started Blocking Windows 7/8.1 Updates For PCs Running New Processors

The assault plant on every version of Windows OS from Windows XP to Windows 10 as well as is difficult to block because the malicious code tin hold upwards re-injected into the targeted legitimate procedure later the organization reboots – Thanks to the persistent registry key.

The researchers said nigh of the today's safety products on the marketplace position are susceptible to the DoubleAgent attacks. Here's the listing of affected safety products:

• Avast (CVE-2017-5567)
• AVG (CVE-2017-5566)
• Avira (CVE-2017-6417)
• Bitdefender (CVE-2017-6186)
• Trend Micro (CVE-2017-5565)
• Comodo
• ESET
• F-Secure
• Kaspersky
• Malwarebytes
• McAfee
• Panda
• Quick Heal
• Norton

After hijacking the anti-virus software, attackers tin also usage the DoubleAgent assault to disable the safety product, making it blind to malware as well as cyber attacks, using the safety production equally a proxy to launch attacks on the local calculator or network, elevating the user privilege grade of all malicious code, hiding malicious traffic or exfiltrate data, or damaging the OS or causing a denial of service.

Note: Cybellum researchers entirely focused on anti-virus programs, though the DoubleAgent assault could move amongst whatsoever application, fifty-fifty Windows operating organization itself.

Many Antiviruses Still Unpatched Even After ninety Days Of Responsible Disclosure

Cybellum said the companionship had reported the DoubleAgent assault to all affected anti-virus vendors to a greater extent than than ninety days ago.

Cybellum researchers possess got been working amongst around anti-virus companies to acre the issue, only then far, entirely Malwarebytes as well as AVG possess got released a patch, spell Trend-Micro has planned to unloose i soon, equally well.

So, if you lot usage whatsoever of the 3 apps mentioned above, you lot are strongly advised to update it equally shortly equally possible.

As a mitigation, the researchers greenback that the simplest laid upwards for antivirus vendors is to switch from Application Verifier to a newer architecture called Protected Processes.

Protected processes machinery protects anti-malware services against such attacks past times non allowing other apps from injecting unsigned code, only this machinery has then far been implemented entirely inwards Windows Defender, which was introduced past times Microsoft inwards Windows 8.1.

Cybellum has also provided a video demonstration of the DoubleAgent attack, showing how they turned an antivirus app into a ransomware that encrypts files until you lot pay up.

The companionship also posted proof-of-concept (PoC) code on GitHub, as well as 2 blog posts detailing the DoubleAgent attack.

Share This :