GhostHook Attack Bypasses Windows 10 PatchGuard

EASTER · Jun 22, 2017

https://threatpost.com/ghosthook-attack-bypasses-windows-10-patchguard/126462/

CyberArk concedes this may be a difficult fix for Microsoft, and said the quickest path to a fix may come from security vendors whose products hook in to PatchGuard. Intel PT, which was released months after PatchGuard, enables security vendors to monitor stacks of commands that are executed in the CPU in order to identify attacks before they reach the operating system.

“We are able to execute code in the kernel and go unnoticed by any security feature Microsoft produces,” said Kobi Ben Naim, senior director of cyber research. “Many other security vendors rely on PatchGuard and on DeviceGuard in order to receive reliable information and analyze whether it’s benign or an attack.
Click to expand...

“We think it’s pretty critical,” Naim said. “The real impact is if an attacker uses it, they can go uncovered for many months before someone will notice something is wrong. If we can take this capability and add it to ransomware, it would be pretty catastrophic. No player will be able to stop them once they are executing code behind PatchGuard. Today ransomware works in user mode because of PatchGuard. If they were able to execute this code behind PatchGuard, it will be a catastrophic effect.”
Click to expand...

ronjor · Jun 22, 2017

Posted here. > https://www.wilderssecurity.com/threads/ghosthook-attack-bypasses-windows-10-patchguard.394948/

Log in or Sign up

GhostHook Attack Bypasses Windows 10 PatchGuard

EASTER Registered Member

ronjor Global Moderator

Log in or Sign up

GhostHook Attack Bypasses Windows 10 PatchGuard

EASTER Registered Member

ronjor Global Moderator

Useful Searches