Defender-Pretender: When Windows Defender Updates Become a Security Risk
No ratings
Presented at BlackHat USA 2023 by
EDRs evolved over the years and become the endpoint's most powerful layer of security. The signature update process is a critical component of security controls, without it, the security control would be useless against new threats. Security update processes should be highly protected, as we learned a decade ago from the notorious Flame malware attack. This attack implemented a MITM based on a rogue certificate to impersonate Microsoft updates to deliver malware, disguised as legitimate Microsoft code, to unsuspecting users.This kind of attack usually requires nation state capabilities since the signature update files are signed by Microsoft. We wondered if we could achieve the same capabilities running as an unprivileged user without possessing a rough certificate and without using MITM, instead, we aimed to turn the original Windows Defender process to our full control.In this talk we will present our journey starting with a deep dive into Windows Defender architecture, the signature database format and the signature update process, focusing on the security verification logic. We will present how an adversary can totally own any Windows agent and server in the world by exploiting a powerful 0day vulnerability that even we didn't expect to discover. Enterprise machines are also at risk since the vulnerability affects Microsoft 365 Defender as well.We will demonstrate Defender-Pretender, an open-source tool we developed and executed as an unprivileged user to achieve multiple attack vectors.Defender-Pretender neutralizes the EDR and allows any already known malicious code to run fully undetected and makes Defender delete admin's data. We also achieved the ability to delete OS and driver files resulting in a fully unrecoverable OS. Finally, we even provide the ability to change the Windows Defender behavior by modifying its detection and mitigation logic.