SoylentNews is people
SoylentNews
AtomBomb: The New Zero-Day Windows Exploit Microsoft Can't Fix?
There's a new zero-day Microsoft Windows exploit in the wild by the name of AtomBomb, and Microsoft may not be able to fix it.
Ensilo security researchers have discovered a new zero-day exploit in Windows that attackers can make use of to inject and execute malicious code. The researches call the exploit AtomBombing because of its use of a Windows function called Atom Tables.
What's particularly interesting about the exploit is that it does not rely on security vulnerabilities in Windows components but native Windows functions. This means, according to the researchers, that Microsoft won't be able to patch the issue.
It is particularly worrying that the issue affects all versions of Windows, and that security programs that run on the system -- firewall or antivirus for instance -- won't stop the execution of the exploit.
The technique works in the following way on an abstract level:
- Malicious code needs to be executed on a Windows machine. A user might run malicious code for instance.
- This code is blocked usually by antivirus software or other security software or policies.
- In the case of AtomBombing, the malicious program writes the malicious code in an atom table (which is a legitimate function of Windows and won't be stopped therefore).
- It then uses legitimate processes via APC (Async Procedure Calls) , a web browser for instance, to retrieve the code from the table undetected by security software to execute it.
You can find an extremely detailed explanation of AtomBombing here. Time to run Windows only in VMs?
New code injection attack works on all Windows versions - Help Net Security
Source: https://www.helpnetsecurity.com/2016/10/28/code-injection-windows-atombombing/
(Score: 1, Informative) by Anonymous Coward on Monday October 31 2016, @02:11AM
ISTM that Francis is working on decade-old datapoints.
Had he sought out local Linux people, I'll bet his "Nuh-uh"s would have already been turned to "Oh, wow"s.
In his area, perhaps there is a Linux Users Group. [google.com]
If not that, maybe an individual.
I've suggested before getting up with a Linux guy for hands-on help. [soylentnews.org]
the driver availability is a valid point. Old, limited popularity, and out of production scanners will never get driver support
If device drivers truly don't exist for his hardware, there are HUNDREDS of guys waiting in line to make more stuff Linux-compatible.
Why Linux Has The Best Hardware Support Of Any OS (The Linux Driver Project) [googleusercontent.com] (orig) [lwn.net]
(The significant text is found at "300".)
If the Linux Driver Project guys can get their hands on it, a piece of the gear should have Linux support in no time.
If the particular item isn't especially popular but the user can find a cluster of other folks who are interested in using it under Linux, that should help convince the LDP guys to support it.
Putting a bounty on the driver might be further stimulus.
...and, before anyone mentions games, we're still talking about being forced to use company-provided stuff in a work environment. Right?
-- OriginalOwner_ [soylentnews.org]