Clik here to view.
ArdBot: A Malware Under Construction
Recently we came across a new sample of the ArdBot malware, appearing on kernelmode, credited to R136a1. A research of this sample showed a malware strain that is not yet ready for production use and...
View ArticleClik here to view.
Analyzing Furtim: Malware that Avoids Mass-Infection
Overview Recently we came across a new malware strain, first discovered by @hFireF0X, and at point of discovery, it was not detected by any of the 56 anti-virus programs tested by VirusTotal service....
View ArticleClik here to view.
Documenting the Undocumented: Adding CFG Exceptions
TL;DR Microsoft’s Control Flow Guard (CFG) is a security feature that prevents the abuse of indirect calls from calling addresses that are not marked as safe. CFG can cause problems for anyone trying...
View ArticleClik here to view.
Captain Hook: Pirating AVs to Bypass Exploit Mitigations
tl;dr: We found 6(!) different common security issues that stem from incorrect implementation of code hooking and injections techniques. These issues were found in more than 15 different products. The...
View ArticleClik here to view.
Elastic Boundaries – Elevating privileges by environment variables expansion
Even though any process is provided variables from its environment – they are often overlooked by users, developers and sometimes even the OS itself. Environment variables are an essential part of any...
View ArticleClik here to view.
AtomBombing: Brand New Code Injection for Windows
TL;DR Here’s a new code injection technique, dubbed AtomBombing, which exploits Windows atom tables and Async Procedure Calls (APC). Currently, this technique goes undetected by common security...
View ArticleClik here to view.
AtomBombing CFG Protected Processes
TL;DR we show AtomBombing modifications to enable us to inject code into CFG-protected processes. In the last blog, we showed AtomBombing against MSPaint.exe and to recall, at that stage the...
View ArticleClik here to view.
Command Injection/Elevation – Environment Variables Revisited
Windows environment variables can be used to run commands and can also be used to bypass UAC, allowing an attacker with limited privileges to take complete control of the system. This code leverages a...
View ArticleClik here to view.
Windows’ PsSetLoadImageNotifyRoutine Callbacks: the Good, the Bad and the...
tl;dr: Security vendors and kernel developers beware – a programming error in the Windows kernel could prevent you from identifying which modules have been loaded at runtime. Introduction During...
View ArticleClik here to view.
Windows’ PsSetLoadImageNotifyRoutine Callbacks: the Good, the Bad and the...
tl;dr: Security vendors and kernel developers beware – a programming error in the Windows kernel could prevent you from identifying which modules have been loaded at runtime. And the fix for it isn’t...
View Article