October 31, 2016 By Larry Loeb 2 min read

Researchers from enSilo may have too much time on their hands: Instead of putting out fires, they came up with a method to nuke Windows security. To make it worse, this attack vector cannot be patched because of how it uses Windows atom tables, which are basic system calls, to operate.

Windows Atom Tables

Softpedia noted that Windows features a data structure called an atom table. It’s a system-defined table that stores strings and corresponding identifiers.

Applications place a string inside an atom table and receive a 16-bit integer, called an atom, in return. This atom can then access the string. Because they are shared tables, different apps can access and alter data inside them.

Code injection is a popular cybercriminal tool, and fraudsters often use it to place malicious code into legitimate processes. This makes it easier for an attacker to bypass security products, hide from the user and extract information that would otherwise be unattainable.

enSilo found that an attacker could write malicious code into an atom table, which would “force a legitimate program to retrieve the malicious code from the table.” The researchers also found that cybercriminals could alter the infected program to execute that malicious code.

An Atomic Cocktail

This novel injection method bypasses the signature-based recognition of most endpoint security products. Additionally, those tools usually include a white list of trusted processes — which often include atom tables. Should an attacker inject malware code into one of those trusted processes, the security product in question could be fooled.

Such an attack vector would be very useful in a man-in-the-browser (MitB) attack, which is often seen in banking Trojans. Malware using this vector may also take screen shots of the user’s screen or access encrypted passwords. In fact, it could perform any other action that a white listed application could.

AtomBombing

AtomBombing, as enSilo called it, will affect all Windows versions. There is no patch to remediate this kind of attack, since the underlying problem is a design flaw, not a vulnerability.

The only hope enSilo sees requires a different take on how the security product works. “The direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity,” the report explained. An alternative solution would be to replace Windows with a more secure operating system.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today