Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Sunday October 30 2016, @04:58PM   Printer-friendly
from the don't-run-unknown-code! dept.

AtomBomb: The New Zero-Day Windows Exploit Microsoft Can't Fix?

There's a new zero-day Microsoft Windows exploit in the wild by the name of AtomBomb, and Microsoft may not be able to fix it.

Ensilo security researchers have discovered a new zero-day exploit in Windows that attackers can make use of to inject and execute malicious code. The researches call the exploit AtomBombing because of its use of a Windows function called Atom Tables.

What's particularly interesting about the exploit is that it does not rely on security vulnerabilities in Windows components but native Windows functions. This means, according to the researchers, that Microsoft won't be able to patch the issue.

It is particularly worrying that the issue affects all versions of Windows, and that security programs that run on the system -- firewall or antivirus for instance -- won't stop the execution of the exploit.

The technique works in the following way on an abstract level:

  1. Malicious code needs to be executed on a Windows machine. A user might run malicious code for instance.
  2. This code is blocked usually by antivirus software or other security software or policies.
  3. In the case of AtomBombing, the malicious program writes the malicious code in an atom table (which is a legitimate function of Windows and won't be stopped therefore).
  4. It then uses legitimate processes via APC (Async Procedure Calls) , a web browser for instance, to retrieve the code from the table undetected by security software to execute it.

You can find an extremely detailed explanation of AtomBombing here. Time to run Windows only in VMs?

New code injection attack works on all Windows versions - Help Net Security

Source: https://www.helpnetsecurity.com/2016/10/28/code-injection-windows-atombombing/


Original Submission #1Original Submission #2

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 1) by Francis on Sunday October 30 2016, @09:42PM

    by Francis (5544) on Sunday October 30 2016, @09:42PM (#420656)

    Sigh, more name calling and no actual useful information.

    First off, I'm familiar with SANE, I've used it in the past and it works fine for basic flatbed functionality. It does not handle document feeders, OCR, organization and it does not result in a copy that's accepted by the IRS during audits. Plus, there are better options anyways. It's something that kind of works for simple things, but not if you've got more complicated things you want to do.

    As far as DVD region encoding goes, why should I waste time looking for a solution when I have one that works? I have the software it works reliably on my computer, why on earth should I waste time looking for another solution that may or may not work when I've got one that does?

    I'm a bit surprised that you're willing to post this bullshit under your name.

  • (Score: 2, Troll) by aristarchus on Sunday October 30 2016, @09:52PM

    by aristarchus (2645) on Sunday October 30 2016, @09:52PM (#420662) Journal

    I'm a bit surprised that you're willing to post this bullshit under your name.

    Feeling is mutual. Aren't you just the slightest bit embarrassed to admit such ignorance on a moderately techie site?

    I have the software it works reliably on my computer, why on earth should I waste time looking for another solution that may or may not work when I've got one that does?

    So, how much does Micro$erft pay you, or are you truely so unaware of what software is, how operating systems work, and how in the current instance, if you have read the Fine Article, Windows is totally hosed. Works reliably? Are we supposed to take this as a joke?

    I was just trying to help liberate you from bondage, Francis, but you know, the first step is realizing you are enslaved. It is something you should know.

    • (Score: 0, Flamebait) by Francis on Monday October 31 2016, @04:03AM

      by Francis (5544) on Monday October 31 2016, @04:03AM (#420771)

      No, you're being an asshole. People like you are why I use FreeBSD rather than Linux as my primary install. I just want a system that works reliably without the zealotry.

      I did the research on this stuff at the time that I decided what software I was going to use and I don't see any reason why I should stop using what works for me. Nothing you've recommended does what my current set up does on my machine. I don't see any purpose in setting aside the stuff I bought back when I was dual-booting between Windows and FreeBSD just because I've got my Windows install loaded into a VM.

      Nothing you've suggested is anywhere near as functional as what I'm currently using.

      Also, I think it's cute that you think I care what you think of me. All you've done in this thread is make an ass of yourself.

      • (Score: 2, Informative) by aristarchus on Monday October 31 2016, @06:09AM

        by aristarchus (2645) on Monday October 31 2016, @06:09AM (#420797) Journal

        Nothing you've recommended does what my current set up does on my machine. I don't see any purpose in setting aside the stuff I bought back when I was dual-booting between Windows and FreeBSD just because I've got my Windows install loaded into a VM.

        Nothing you've suggested is anywhere near as functional as what I'm currently using.

        Francis, my poor Francis! You have admitted to running Windows because you did not know what else to do. I never suggested any solutions, since you did not provide enough details to see what your problem was, other than that you were running Windows. And it is funny how, when ever I try to assist you, as opposed to anyone else on SoylentNews, I get modded down. Hmm. Well, that is it. It is war, Francis! I will follow you, and every post you make I will mod down mercilessly! I will taunt you as an AC, and I will imitate your username on other fora accross the internet until you realize the errors of your ways and apologize for posting totally ignorant things here on SoylentNews. Deal?

        • (Score: 1, Informative) by Anonymous Coward on Monday October 31 2016, @02:46PM

          by Anonymous Coward on Monday October 31 2016, @02:46PM (#420878)

          It's not just Francis. I mod you down too, especially because of pointless dickwaving posts like this.

          • (Score: 3, Funny) by aristarchus on Monday October 31 2016, @04:16PM

            by aristarchus (2645) on Monday October 31 2016, @04:16PM (#420916) Journal

            Francis! Posting as AC and calling yourself "not just Francis" does not mean you are not just Francis! You're not fooling anyone, you know!

            • (Score: 0) by Anonymous Coward on Monday October 31 2016, @05:38PM

              by Anonymous Coward on Monday October 31 2016, @05:38PM (#420944)

              Just keep telling yourself that.

              • (Score: 0) by Anonymous Coward on Monday October 31 2016, @06:33PM

                by Anonymous Coward on Monday October 31 2016, @06:33PM (#420961)

                Aristarchus is right! You can't just hide behind AC, Francis! Maybe if you knew how scanner drivers and DVD drives worked, you might have a chance to pull it off, but this is just too obvious.

      • (Score: 0) by Anonymous Coward on Tuesday November 01 2016, @03:00AM

        by Anonymous Coward on Tuesday November 01 2016, @03:00AM (#421109)

        that's b/c you're a hooker.

        • (Score: 0) by Anonymous Coward on Tuesday November 01 2016, @09:07AM

          by Anonymous Coward on Tuesday November 01 2016, @09:07AM (#421176)

          that's b/c you're hooked.

          FTFY! Trolling, trolling, over the deep blue sea! I just wonder, if you know it's me?

  • (Score: 3, Informative) by frojack on Sunday October 30 2016, @10:07PM

    by frojack (1554) on Sunday October 30 2016, @10:07PM (#420667) Journal

    It does not handle document feeders, OCR, organization and it does not result in a copy that's accepted by the IRS during audits.

    It does handle document feeders. (I use this all the time)
    It does handle OCR, I use this also.
    It does handle organizations, I don't use this a lot but I do use it occasionally
    And it can result in a perfect PDF copy as well as the original images available if you want them.

    The fact that nobody uses it that way for all those things is beside the point. Its also not the only scanner software available for linux.

    But the driver availability is a valid point. Old, limited popularity, and out of production scanners will never get driver support. New scanners from large companies now tend to release drivers for opensource concurrently with Windows. Especially the network attached scanners.

    And the IRS requirements are not particularly onerous. The IRS has allowed taxpayers to use electronic receipts as documentary evidence since 1997.

    --
    No, you are mistaken. I've always had this sig.
    • (Score: 2, Redundant) by aristarchus on Sunday October 30 2016, @10:17PM

      by aristarchus (2645) on Sunday October 30 2016, @10:17PM (#420672) Journal

      Truly, this frojack knows a few things.

    • (Score: 1, Informative) by Anonymous Coward on Monday October 31 2016, @02:11AM

      by Anonymous Coward on Monday October 31 2016, @02:11AM (#420739)

      ISTM that Francis is working on decade-old datapoints.

      Had he sought out local Linux people, I'll bet his "Nuh-uh"s would have already been turned to "Oh, wow"s.

      In his area, perhaps there is a Linux Users Group. [google.com]

      If not that, maybe an individual.
      I've suggested before getting up with a Linux guy for hands-on help. [soylentnews.org]

      the driver availability is a valid point. Old, limited popularity, and out of production scanners will never get driver support

      If device drivers truly don't exist for his hardware, there are HUNDREDS of guys waiting in line to make more stuff Linux-compatible.
      Why Linux Has The Best Hardware Support Of Any OS (The Linux Driver Project) [googleusercontent.com] (orig) [lwn.net]
      (The significant text is found at "300".)

      If the Linux Driver Project guys can get their hands on it, a piece of the gear should have Linux support in no time.
      If the particular item isn't especially popular but the user can find a cluster of other folks who are interested in using it under Linux, that should help convince the LDP guys to support it.
      Putting a bounty on the driver might be further stimulus.

      ...and, before anyone mentions games, we're still talking about being forced to use company-provided stuff in a work environment. Right?

      -- OriginalOwner_ [soylentnews.org]

    • (Score: 0, Troll) by Francis on Monday October 31 2016, @04:06AM

      by Francis (5544) on Monday October 31 2016, @04:06AM (#420772)

      I've tried opensource OCR and I've yet to find one that works well. Certainly not well enough for me to ditch my current system for.

      IIRC, the best software I came across was Tesseract, but that didn't work very well for the things I was scanning. It's probably better now than then, but I don't see much point in dumping software and hardware I already have just to use open source. I've ditched most of the software I used to use for equivalents and that's worked fine, but as long as I can run the few remaining pieces of software in a VM, I don't see much purpose to ditching it for the sake of ditching it.

      And even if I do ditch it, then I have to go back to retaining all my receipts and similar in order to do my taxes, which greatly reduces the point of using my neat receipts in the first place.