October 31, 2016 By Larry Loeb 2 min read

Researchers from enSilo may have too much time on their hands: Instead of putting out fires, they came up with a method to nuke Windows security. To make it worse, this attack vector cannot be patched because of how it uses Windows atom tables, which are basic system calls, to operate.

Windows Atom Tables

Softpedia noted that Windows features a data structure called an atom table. It’s a system-defined table that stores strings and corresponding identifiers.

Applications place a string inside an atom table and receive a 16-bit integer, called an atom, in return. This atom can then access the string. Because they are shared tables, different apps can access and alter data inside them.

Code injection is a popular cybercriminal tool, and fraudsters often use it to place malicious code into legitimate processes. This makes it easier for an attacker to bypass security products, hide from the user and extract information that would otherwise be unattainable.

enSilo found that an attacker could write malicious code into an atom table, which would “force a legitimate program to retrieve the malicious code from the table.” The researchers also found that cybercriminals could alter the infected program to execute that malicious code.

An Atomic Cocktail

This novel injection method bypasses the signature-based recognition of most endpoint security products. Additionally, those tools usually include a white list of trusted processes — which often include atom tables. Should an attacker inject malware code into one of those trusted processes, the security product in question could be fooled.

Such an attack vector would be very useful in a man-in-the-browser (MitB) attack, which is often seen in banking Trojans. Malware using this vector may also take screen shots of the user’s screen or access encrypted passwords. In fact, it could perform any other action that a white listed application could.

AtomBombing

AtomBombing, as enSilo called it, will affect all Windows versions. There is no patch to remediate this kind of attack, since the underlying problem is a design flaw, not a vulnerability.

The only hope enSilo sees requires a different take on how the security product works. “The direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity,” the report explained. An alternative solution would be to replace Windows with a more secure operating system.

More from

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today