Windows EFS Feature May Help Ransomware Attackers

guest · Jan 21, 2020

Signature-based software may not be enough to protect Microsoft’s Windows EFS against evolving ransomware families
Windows EFS Feature May Help Ransomware Attackers
January 21, 2020
https://www.bleepingcomputer.com/news/security/windows-efs-feature-may-help-ransomware-attackers/

Security researchers have created concept ransomware that takes advantage of a feature in Windows that encrypts files and folders to protect them from unauthorized physical access to the computer.
Abusing a legitimate feature
Researchers at Safebreach Labs developed concept ransomware that relies on EFS to lock files on a Windows computer. The way it functions is described in the steps below: [...]
Restoring the files to their readable state requires decrypting the key files using the attacker's private key.
Viable technique
Amit Klein, VP of security research at SafeBreach, told BleepingComputer that although EFS malware seems theoretical, a live sample proves the opposite and the technique used could soon emerge in the wild.
Click to expand...

To show that EFS ransomware could be a feasible threat, the researchers tested their sample on three security solutions with anti-ransomware capabilities from ESET (Internet Security 12.1.34.0), Kaspersky (Anti Ransomware Tool for Business 4.0.0.861a), and Microsoft (Windows 10 Controlled Folder Access on Windows 10 64-bit version 1809, build 17763).

Results showed that files on virtual Windows 10 machines infected with EFS could not be protected by the above-mentioned solutions.
Click to expand...

SafeBreach: EFS Ransomware

guest · Jan 21, 2020

Antivirus vendors push fixes for EFS ransomware attack method
January 21, 2020
https://www.zdnet.com/article/antivirus-vendors-scramble-to-fix-new-efs-ransomware-attack/

According to the researchers, the encryption activities of EFS-based ransomware take place in the kernel and as the NTFS driver is in play, may also go unnoticed by file-system filter drivers. No human interaction or administration rights are required.
However, padlock icons are shown when files are encrypted -- which may give victims an indication that all is not well -- and if Data Recovery Agent is enabled, recovery can be "trivial," the team says.

Below is the rundown on each vendor, their susceptibility, and any actions taken: [...]
A possible workaround is for administrators to change registry keys to turn off EFS, as well as use Group Policy in enterprise settings. However, if EFS is in active and legitimate use, then disabling the setting may impact required file protections.

"It is clear that in the face of the expected evolution of ransomware, that new anti-ransomware technologies need to be developed if the ransomware threat is to be contained and kept at bay," the researchers say.
"Signature-based solutions are not up to this job, heuristics-based (and even more so -- generic technology-based) solutions seem more promising, but additional proactive research is required in order to "train" them against future threats."
Click to expand...

Sampei Nihira · Jan 21, 2020

The service EFS is also present in my W.10 Home.
Stopped - manually.
It can also be started from SUA.
I have disabled the service.

itman · Jan 21, 2020

Sampei Nihira said: ↑

I have disabled the service.
Click to expand...

If you are using a password manager or such like app, this will surely bust it.

itman · Jan 21, 2020

Per the zdnet.com article, this Microsoft "tidbit" in regards to WD:

Microsoft, Windows Controlled Folder Access: "Microsoft considers Controlled Folder Access a defense-in-depth feature. We assessed this submittal to be a moderate class defense-in-depth issue, which does not meet the Microsoft Security Servicing Criteria for Windows. Microsoft may consider addressing this in a future product."

Click to expand...

Sampei Nihira · Jan 21, 2020

Hi itman
, read this much more accurate article:

https://safebreach.com/Post/EFS-Ransomware

.....The Windows operating system (starting with Windows 2000) offers a feature called EFS (Encrypting File System) for its business users (the Pro, Professional, Business, Ultimate, Enterprise and Education editions, depending on the Windows version).....
Click to expand...

Yet in my W.10 Home the EFS service is present.
Stopped - Manual
When I tried to start the service then it was no longer possible to stop it.
I had to use the command prompt as an administrator:

sc config EFS start= demand

reboot pc

The "sc" command must therefore also be monitored.
OSA has an ad hoc rule.

P.S. I don't use a password manager or similar app.

itman · Jan 21, 2020

This POC EFS attack withstanding, EFS has an existing vulnerability:

EFS encryption encrypts files or folders one by one. Unlike BitLocker that encrypts them together. This also means that when a file is executed, and Windows creates a temporary cache of that file, that temporary cache can be used as a leak to the information and unauthorized access can be taken over by an unintended user. EFS works with NTFS only.
Click to expand...

https://www.thewindowsclub.com/encrypting-file-system-efs-windows-10

Now we have to wait for a BitLocker POC vulnerability .......................

Sampei Nihira · Jan 23, 2020

@itman

Read the 3D below:

https://malwaretips.com/threads/windows-efs-feature-may-help-ransomware-attackers.97946/#post-855303

itman · Jan 23, 2020

Sampei Nihira said: ↑

@itman

Read the 3D below:

https://malwaretips.com/threads/windows-efs-feature-may-help-ransomware-attackers.97946/#post-855303
Click to expand...

I am not worried about this vulnerability since my AV detects the exploit attempt; unlike WD.

I was researching the POC yesterday and at least one API employed requires SMB v3.0+. This would indicate that pre-Win 8.1 OS versions are not vulnerable.

Rasheed187 · Jan 25, 2020

Sampei Nihira said: ↑

The service EFS is also present in my W.10 Home.
Stopped - manually.
It can also be started from SUA.
I have disabled the service.
Click to expand...

Yes, it's also on Win 8.1 Home, probably best to disable it.

Log in or Sign up

Windows EFS Feature May Help Ransomware Attackers

guest Guest

guest Guest

Sampei Nihira Registered Member

itman Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Rasheed187 Registered Member

Log in or Sign up

Windows EFS Feature May Help Ransomware Attackers

guest Guest

guest Guest

Sampei Nihira Registered Member

itman Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Sampei Nihira Registered Member

itman Registered Member

Rasheed187 Registered Member

Useful Searches