The Dangers of VHD and VHDX Files

guest · Sep 4, 2019

The Dangers of VHD and VHDX Files
September 4, 2019
https://insights.sei.cmu.edu/cert/2019/09/the-dangers-of-vhd-and-vhdx-files.html

Recently, I gave a presentation at BSidesPGH 2019 called Death By Thumb Drive: File System Fuzzing with CERT BFF. (The slides from my presentation are available in the SEI Digital Library.) Although my primary goal was to find bugs in kernel file-system-parsing code, a notable part of my research was investigating attack vectors. In particular, I focused on VHD and VHDX files on Windows systems. In this post, I describe some of the risks associated with these two file types.

After fuzzing file system images with BFF, I was able to find several different ways to crash Windows as the result of it mounting a corrupted disk. Physically plugging in a USB mass storage device with a corrupted file system was the obvious attack vector.

Just like VHD and VHDX files, the contents of ISO or IMG files do not carry the MOTW of the containing file. And just like VHD and VHDX files, starting with Windows 8, ISO and IMG files can be opened with a double click. Unlike VHD and VHDX files, however, there's a better chance that a deployed antivirus product may detect malware contained in an ISO or IMG file.
Click to expand...

VHD/VHDX Files and MOTW
From a user experience perspective, starting with Windows 8, VHD and VHDX files can have a function similar to ZIP files. That is, the user double-clicks on the file to show its contents in Windows Explorer. The important difference is that the files contained within a VHD or VHDX container do not retain the MOTW of the container file.

What does this mean from the end user's perspective? Any file contained within a VHD or VHDX file will not receive the same protections that Windows provides against files that originated from the Internet.
Click to expand...

Conclusion and Recommendations
VHD and VHDX files can be dangerous. Due to the combination of kernel-level file system parsing and also lack of MOTW tagging to their contents, allowing VHD or VHDX files to arrive at endpoints increases the risk presented to those systems.

Block VHD, VHDX, IMG, and ISO files at email gateways.

Unregister the VHD, VHDX, IMG, and ISO file extensions in Microsoft Windows Explorer.

Restrict VHD, VHDX, IMG, and ISO files at web gateways. (There are some legitimate reasons for these files to be downloaded, so ensure that any restrictions do not block legitimate business needs.)

Click to expand...

Log in or Sign up

The Dangers of VHD and VHDX Files

guest Guest

Log in or Sign up

The Dangers of VHD and VHDX Files

guest Guest

Useful Searches