text: Information security bods at Trustwave have found a zero-day exploit affecting all versions of Microsoft's OS Windows, all the way from Windows 2000 up to a fully patched version of Windows 10 including all server editions.
  It estimates that this affects 1.5 billion computers around the world.
  The company provides threat intelligence services and regularly monitors several forums, and it is through this it discovered the exploit which was found on a Russian speaking forum and is currently being offered for sale for £62,000 ($US 90,000).
  Trustwave cautioned that there is currently no fix for the exploit and has recommended Windows users stay vigilant for phishing emails. In addition, it has also issued a more general warning about the rise of malware-as-a-service (MaaS).
  Ziv Mador, VP of security research at Trustwave, told SCMagazineUK.com, “This is a very serious exploit. From what we've seen in the past, exploits of this type tend to have somewhere in the region of a 10 percent success rate which spells bad news all around.”
  According Trustwave, Microsoft has been notified of the zero day offering and is continuing to monitor the situation.
  In a blog post, the company highlighted that, “This specific forum serves as a collaboration platform where one can hire malware coders, lease an exploit kit, buy web shells for compromised websites, or even rent a whole botnet for any purpose. However, finding a zero day listed in between these fairly common offerings is definitely an anomaly. It goes to show that zero days are coming out of the shadows and are fast becoming a commodity for the masses, a worrying trend indeed.”
  Trustwave said it did not buy the exploit, so could not offer technical details on how it works. However, Mador explained, “The exploit found circumvents the Local Privilege Escalation security feature of Windows which asks you to enter an admin password to make changes to the computer. This is a crucial part of the malware infection being successful.”
  A translation of the original Russian post says, “The vulnerability exists in the incorrect handling of Windows objects, which have certain properties.”
  It goes on to explain, “The vulnerability is of 'write-what-where' type, and as such allows one to write a certain value to any address [in memory], which is sufficient for a full exploit. The exploit successfully escapes from ILL/appcontainer (LOW), bypassing (more precisely: doesn't get affected at all [by]) all existing protection mechanisms such as ASLR, DEP, SMEP, etc. [The exploit] relies solely on the KERNEL32 and USER32 libraries [DLLs].”
  The seller provided two proof videos for any potential buyers that might be concerned with the validity of the offer. The first video shows a fully updated Windows 10 machine being exploited successfully, by elevating the CMD EXE process to the SYSTEM account. It is interesting to note that the video was actually recorded on "Patch Tuesday" and the author made sure the latest updates were installed.
  [hm-iframe width="420" height="315" frameborder="0" src="https://www.youtube.com/embed/qElVJY9-CIg"]
  The second video shows the exploit successfully bypassing all of EMET protections for the latest version of the product.
  [hm-iframe width="420" height="315" frameborder="0" src="https://www.youtube.com/embed/7G1ZwL5PQfE"]
  Trustwave highlighted, “It's important to mention that despite the indications that the offer is authentic, there's no way to know this with absolute certainty without taking the risk of purchasing the exploit or waiting for it to appear in the wild.”
  Due to all the "unknowns" associated with zero days, it's hard to provide specific advice for protection. However Trustwave said that if you keep your software up-to-date, take a layered approach to security, and use common sense you should be OK.
  Ben Johnson, chief security strategist, Carbon Black commented by email to SC that, “Zero-day exploits such as this are particularly problematic, as traditional security solutions like anti-virus rely on blacklisting – they have a set of known threats that they detect, if a file doesn't appear on their list, they let it through – so if the threat has never been seen before then this system falls down.”
  Johnson explained, “This is why organisations need to stop relying on AV alone to protect their endpoints; a more sophisticated approach is needed. Whitelisting, whereby a threat is assessed against a set of policies and common characteristics to see if there is a likely issue, can help to spot this type of exploit even if it has never appeared before. This should then be combined with broader threat intelligence, where you can see if a particular file has ever been seen before; if it hasn't, then it is likely to be zero day and hazardous. This allows organisations to get smarter about security and avoid falling into these sort of traps.”
  Related
  Careers
  Modernize recruitment to close the cybersecurity talent gap
  Michel Huffaker November 30, 2021
  The industry needs to take on a more realistic approach to attract and retain cybersecurity talent.
  Wireless security
  The CISO Stories Podcast Listen: Learning how to get to ‘yes’ as a CISO
  SC Staff November 24, 2021
  Internationally recognized cybersecurity leader Dan Lohrmann learned how to get to “yes” the hard way when he was the chief information security officer at the state of Michigan.
  Training
  Cyberattacks often come after working hours. Here’s how to prepare.
  Bradley Barth November 24, 2021
  ISACA leaders offer recommendations for supporting your IT/security staffers as they respond to a holiday or weekend cyber incident.
  Related Events
  eSummit
  Third Party Risk and the Supply Chain
  WED JAN 26 — THU JAN 27
  Cybercast
  How to Implement Cloud Security That Actually Works: Lessons From the Front Lines
  THU JAN 1
  Cybercast
  Top 7 Ways to Evaluate a SASE Service
  THU JUL 15
  About UsSC MediaCyberRisk AllianceContact UsPrivacy
  Get InvolvedSubscribeContribute/SpeakAttend an eventJoin a peer group
  ExploreProduct reviewsResearchWhite papersWebcastsPodcasts
  Copyright © 2021 CyberRisk Alliance, LLC All Rights Reserved This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization.
  Your use of this website constitutes acceptance of CyberRisk Alliance Privacy Policy and Terms & Conditions.