Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a “general-purpose logging service used by software clients running in user-mode or kernel-mode.” By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System. Turning a Windows defense against itself The attack exploits the interaction of CLFS, Windows Defender, and Windows file permissions. The exploit uses Windows Defender to open a log file created by a standard user by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates.Read full article Comments
Windows 0-day dropped by disgruntled researcher hands hackers System rights
AR
Ars TechnicaBy
Dan Goodin
EXECUTIVE SUMMARY
"SignDrop" exploit lets local users gain all-powerful System rights.
Key Takeaways
- Windows 0-day dropped by disgruntled researcher hands hackers System rights.
- "SignDrop" exploit lets local users gain all-powerful System rights.
- Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day.
Read Complete Original Article
Published originally on Ars Technica
