New ETW Attacks Can Allow Hackers to 'Blind' Security Products

guest · Nov 18, 2021

New ETW Attacks Can Allow Hackers to 'Blind' Security Products
November 18, 2021
https://www.securityweek.com/new-etw-attacks-can-allow-hackers-blind-security-products

ETW, which is present by default in Windows since Windows XP, is designed for tracing and logging events associated with user-mode applications and kernel-mode drivers. The ETW in Windows 11 can collect more than 50,000 event types from roughly 1,000 providers, including operating system services, cybersecurity tools, common applications, DLLs, the OS kernel, and drivers.

ETW is leveraged by several endpoint detection and response (EDR) solutions to monitor security-related events and detect malware.
Click to expand...

New ETW attack methods were presented last week at the Black Hat Europe cybersecurity conference by researchers at Binarly, a company that specializes in solutions designed to protect devices against firmware threats.

Binarly researchers have identified two new ETW bypass techniques, which they have demonstrated against Microsoft’s Process Monitor and Windows Defender.
Click to expand...

In the case of Process Monitor, which is popular for malware analysis, the researchers showed how a malicious application with admin privileges on the targeted system can stop the running ETW session associated with Process Monitor and start a fake session. This results in the application no longer receiving network activity telemetry — basically being blinded by the attacker — and the problem does not get fixed even if Process Monitor is restarted.
Click to expand...

In the case of Windows Defender, the researchers showed that it can also be blinded, by assigning zero to registry values that correspond to ETW sessions. This can be done by a malicious kernel driver, by modifying — in kernel memory — fields in kernel structures corresponding to Windows Defender ETW sessions.
Click to expand...

Binarly on Thursday published a blog post describing its findings. The company has also developed open source tools that can be used to identify and prevent ETW attacks. These tools will become available in the upcoming period.
Click to expand...

Binarly: Design issues of modern EDR’s:bypassing ETW-based solutions

As experts in firmware security, the Binarly team is frequently asked why endpoint solutions can’t detect threats originating below the operating system such as firmware implant payloads. Unfortunately, the problem requires a more complex approach and the modern architecture of Endpoint Detection & Response (EDR) solutions are weak against generic attack patterns.
Click to expand...

Log in or Sign up

New ETW Attacks Can Allow Hackers to 'Blind' Security Products

guest Guest

Log in or Sign up

New ETW Attacks Can Allow Hackers to 'Blind' Security Products

guest Guest

Useful Searches