Another attack stopped by Process Guard - an attack on Windows File Protection

[Wayne - DiamondCS]

Here is yet another process attack that Process Guard blocks and protects against. :)
This time the attack is against sfc.dll (Windows File Protection), which a trojan may want to disable so as to be able to modify system files.

The foundations for the attack are described here (http://www.ntdev.org/archive/ntdev0007/msg0130.html) by James Kirby, but put simply, Windows File Protection is made possible thanks to sfc.dll, which is loaded by winlogon.exe. This DLL file exports an unnamed and undocumented function known simply by it's Ordinal - #2, which essentially unloads file protection. The attack is simple: the address of Ordinal #2 is determined, then a call to CreateRemoteThread is made, with the thread start address being the address of Ordinal #2. The thread begins execution and Windows File Protection unloads immediately.

Process Guard (even with just the default, wizard-generated configuration) protects against this by blocking the attacking process from creating a remote thread in winlogon.exe by denying write access (required to create remote threads) - it's that simple.

Here's a screenshot of the attack being blocked. The configuration as you can see is simply the one generated automatically by the wizard (which adds protection for winlogon.exe, amongst others):
http://www.diamondcs.com.au/processguard/images/pg-wfp.gif

[Paul Wilders]

Splendid 8) Have a cookie, Wayne and Jason as well for that matter ;)

regards.

paul

[gkweb]

Good news, we see again that Process Guard is a "must to have" product :)

[ano1]

Still nice! (although the server deleted my first post)

[Pilli]

Well at least the server is back up :)

[an07]

Wayne:

Have you tried this one?
1.
"This example shows the method for a new
startup method. Simply put we are going
to replace a system process, userinit.exe
so that each time someone logs on windows,
our version is executed instead of the
real version.

This requires system file protection
to be bypassed for userinit.exe so
we can modify it.

Below is the replacement userinit.exe
which loads usersvc.cpl, our SFP hook and
then creates a process for usersvc.exe
which is the backup copy of the original
userinit.exe. We must keep this file and
run it each time we ran otherwise windows
will not load properly."

in connection with ...

2.
"As a new feature windows keeps a catalog of hashes
for several files deemed critical. One of which is
userinit. This example shows how to make a clean
backup of userinit and then redirect the system file
protection scanner to the clean backup, allowing
the original to be modified or even deleted.

This is accomplished not by disabling the protection
completely but merely for a select file or files by
hooking NtOpenFile in ntdll.dll."


This method should already be covered by PG, right?

[Marine06]

Very nice! I say have two cookies.. mmmmmmmmmm