"Cloudy with a Chance of Bugs: Attacking the Windows Cloud Files API"

No ratings

Presented at POC 2024 by

Alex Birnberg

Over the past few years, the Cloud Files Mini Filter driver has become a popular target for achieving privilege escalation on Windows from medium integrity. This is the component of the Windows kernel that allows One Drive and other cloud sync engines to provide a seamless experience to the user when interacting with a remote cloud file system. Given that the Cloud Files API can be accessed by an unprivileged process, any user being able to create their own custom cloud sync engine, paired with the fact that the mini filter driver is enabled by default on Windows installations, makes this an ideal target to get kernel control. In this talk, I will introduce you to the design and architecture of this driver, explaining its unique and complex attack surface. Next, I will guide you through the history of vulnerabilities and each of the components that they impact, focusing on the design patterns that led to those vulnerabilities. After understanding the history of vulnerabilities, I will walk you through what made the vulnerabilities I showcased at TyphoonPWN possible, explaining where they fit within the bigger picture. Lastly, I will discuss the challenges that arose while preparing for the hacking competition.