Kapsch BusinessCom. When your Anti-Virus turns against you Are you frightened already?

Transcription

1 Kapsch BusinessCom When your Anti-Virus turns against you Are you frightened already?

2 Florian Bogner Who Am I Information Security Auditor Speaker and Trainer Bug Bounty Hunter Vulnerabilities identified in When your Anti-Virus turns against you 2

3 When your Anti-Virus turns against you 3

4 When your Anti-Virus turns against you 4

5 When your Anti-Virus turns against you 5

6 When your Anti-Virus turns against you 6

7 When your Anti-Virus turns against you 7

8 When your Anti-Virus turns against you 8

9 When your Anti-Virus turns against you TODAY: Getting Local Admin by Abusing the Anti-Virus Quarantine When your Anti-Virus turns against you 9

10 When your Anti-Virus turns against you The Basics Unprivileged User SYSTEM User Interface System State Virus Warning Settings... talks to Windows Service File Access / Scanning Virus Quarantine Updating... User Mode Kernel Mode Kernel Component Remediation (f.e. Process killing) Kernel API Hooking Rootkit Detection When your Anti-Virus turns against you 10

11 When your Anti-Virus turns against you The Basics AV Scanning Engine AV Quarantine Files When your Anti-Virus turns against you 11

12 When your Anti-Virus turns against you The Basics AV Scanning Engine AV Quarantine Files When your Anti-Virus turns against you 12

13 When your Anti-Virus turns against you The Basics AV Scanning Engine manipulates AV Quarantine Files Local Attacker When your Anti-Virus turns against you 13

14 When your Anti-Virus turns against you The Basics AV Scanning Engine manipulates AV Quarantine Files Local Attacker When your Anti-Virus turns against you 14

15 #AVGater // Local Privilege Escalation When your Anti-Virus turns against you 15

16 I ll show you!

17 Summary Emsisoft Anyone can add files to AV quarantine Directory Junctions can then be used to redirect original source path to something else: While restoring the file the permissions of the Windows service are used: Privileged File Write Vulnerability On next reboot: Malicious DLL is loaded by AV Scanning engine. Results in Code Execution as System Local Privilege Escalation: Non-Admin User SYSTEM When your Anti-Virus turns against you 17

18 #AVGater // Local Privilege Escalation When your Anti-Virus turns against you 18

19 I ll show you!

20 Summary Malwarebytes Files can not be added manually to the Quarantine However, there is a race condition between detection and remediation of threats Hence, the file that is placed into the Quarantine can be manipulated! Again, while restoring the file the permissions of the Windows service are used: Privileged File Write Vulnerability On next reboot: Malicious DLL is loaded by AV Scanning engine. Results in Code Execution as System Local Privilege Escalation: Non-Admin User SYSTEM When your Anti-Virus turns against you 20

21 #AVGater // Local Privilege Escalation When your Anti-Virus turns against you 21

22 I ll show you!

23 Summary Kaspersky Files can not be added manually to the Quarantine There is no race condition between detection and remediation. However, the payload file itself can be made malicious. THIS CAN NOT BE FIXED! Hence, it is quarantined! Again, while restoring the file the permissions of the Windows service are used: Privileged File Write Vulnerability Although it s not easily possible to inject DLLs into the AV Scanning engine it can be crashed! (DoS) For Code Execution any other service can be used. Local Privilege Escalation: Non-Admin User SYSTEM When your Anti-Virus turns against you 23

24 #AVGater Summary Getting Local Admin by Abusing the Anti-Virus Quarantine Malicious File 1 Anti-Virus moves file to quarantine Virus Quarantine 2 Attacker manipulates Restore process, so that the file can be placed to any filesystem location Scanning Engine Local Non-Admin Attacker Code Execution as SYSTEM 3 Because of the new filesystem location, the malicious file is loaded by another process, which in turn executes the payload (e.f. DLL Sideloading) Restored File When your Anti-Virus turns against you 24

25 Visit When your Anti-Virus turns against you 25

26 We want you! When your Anti-Virus turns against you 26

27 Vielen Dank für Ihre Aufmerksamkeit. Florian Bogner Information Security Auditor Kapsch BusinessCom AG Kapsch BusinessCom AG Wienerbergstraße Wien, Österreich Phone: Hinweis: Der Inhalt dieser Präsentation ist geistiges Eigentum der Kapsch AG. Alle Rechte hinsichtlich des Kopierens, der Vervielfältigung, Änderung, Nutzung, Veröffentlichung oder Weitergabe des Inhalts an Dritte bleiben vorbehalten. Vorgenanntes ist ohne vorausgehende schriftliche Genehmigung der Kapsch AG ausdrücklich untersagt. Bei Produkt- und Firmennamen kann es sich um eingetragene Markennamen oder geschützte Marken Dritter handeln. Diese werden in der Präsentation lediglich zum Zweck der Verdeutlichung und zum Vorteil des jeweiligen rechtmäßigen Eigentümers ohne eine Absicht der Verletzung der Eigentumsrechte verwendet.