AV Oracle: New hacking technique leverages antivirus to steal secrets

guest · Aug 28, 2019

AV Oracle: New hacking technique leverages antivirus to steal secrets
Windows Defender spills secrets
August 27, 2019
https://portswigger.net/daily-swig/...echnique-leverages-antivirus-to-steal-secrets

A new technique to extract private information from servers protected by Windows Defender has been developed by the TokyoWesterns team.

The method, which was published online after the Capture the Flag (CTF) competition at the WCTF 2019 conference, is a specialized server-side request forgery (SSRF) technique that takes advantage of the security mechanisms embedded in Windows Defender, the default antivirus tool for Microsoft.
Ask the Oracle
AV Oracle is a blind server-side request forgery exploit that could also (possibly) fall under the ‘XS-Search’ category of exploits.
In this case, Windows Defender is acting as an “Oracle,” inadvertently providing the attackers with pertinent information about the host machine.

“Since most antivirus behave the same, the method might potentially work on other endpoint protection tools,” @t0nk42 said in a Twitter chat, but added that for the oracle technique to work, the targeted antivirus tool must have a Jscript analyzer component like Windows Defender.
Click to expand...

“The issue described is specific to the application [TokyoWesterns] studied and not a vulnerability in Windows Defender,” a spokesperson said.
“The application did not follow good data hygiene by storing sensitive data and user-controlled data together in the same file, enabling the researcher access to the sensitive data.”

Google web security researcher Eduardo Vela disputes Microsoft’s rationale on this point.
“It’s common to store user-supplied contents next to secret values,” he said on Twitter. “This proves that to be dangerous thanks to Windows Defender.”
Click to expand...

Log in or Sign up

AV Oracle: New hacking technique leverages antivirus to steal secrets

guest Guest

Log in or Sign up

AV Oracle: New hacking technique leverages antivirus to steal secrets

guest Guest

Useful Searches