Vipersec | Unorthodox Security Blog

Defeating Rollback Protection Software

3rd Dec 2017

Most organizations nowadays put a considerable amount of effort to preserve the integrity of their data. Computers can be misused by employees and clients, system settings can be changed and malicious software can be installed. The problem is usually found in Internet cafés and Universities where shared computers are used a lot.

In response, system administrators install a specific kind of software called Rollback Protection Software (a list of such programs is available here) which locks the operating system in a certain preferred state and prevent any further change. In other words, after the software is set up and the activation is done whatever change takes place in the system is temporary. Everything will be reverted back to its locked stage after each reboot.

The disadvantage of such software is that they actively protect only when the system is running the operating system on which they were installed.

Figure 1 - Computer is booted from the evil USB stick that contains the modified Linux distribution

This means that if anyone boots the system from a linux distribution using a usb stick, mounts the target operating system and makes some changes, these changes are going to be permanent. It needs time to carry out such a procedure and suspicion may rise if done in public.

However, an attacker can automate this procedure in order to spend roughly 5 seconds.

Continue Reading…

Malicious Symbolic Links: Part 2 Antivirus Evasion

13th Nov 2016

In the 1^st part of this series we analyzed the structure of a malicious symbolic link and the flow of the execution. In this part we are going to test the previously created malicious symbolic link against the most popular antivirus products and observe the detection rate.

First of all, as most of you already know there is no algorithm that can perfectly detect all possible threats. Among all the malware detection methods, two of them are the most common to detect malware:

Signature Based Detection: Examining files without executing them and compare the results against a huge database of signatures of already known malware.
Behavioral Based Detection: Allowing applications to get executed but keep monitoring for suspicious activity (changing registry keys, adding applications to system start-up, downloading executable files from the internet, etc).

Figure 1 - Components of an antivirus engine

Malicious Symbolic Links: Part 1 The Concept

6th Oct 2015

While symbolic links are very useful for everyday work, they can also be misused by distributing malware. Of course, to exploit this, the victim has to download a malicious symbolic link via social engineering and execute it.

This can be achieved because the symbolic links can call the command line (cmd.exe) without any limitation to the parameters that will be provided.

Figure 1 - The execution process of the symbolic link

As illustrated in figure 1, in the first stage the symbolic link calls the windows command line and copies itself as a batch file to the temporary directory (this directory is used for storing temporary files and the user always has write permissions).

The batch file gets executed with no problem and generates the vbs (visual basic scripting) malware downloader which finally delivers the malware to the compromised computer.

But lets take a closer look in the malicious symbolic link first.

Continue Reading…

New Security Blog

1st Oct 2015

Hi there, My name is S. and I'm pleased to announce the launch of my new security blog!! I feel pretty excited that I have my own place to share my thoughts.

I will be posting new security tricks that I have discovered by myself, I hope that all of you will like them.
New posts are coming soon!!

Links

Recent Posts