NewApp Digest
search bot

exploit tool

Windows 'Downdate' Attack Makes Patched PCs Vulnerable
Winsage
October 28, 2024

Windows ‘Downdate’ Attack Makes Patched PCs Vulnerable

Recent findings have identified a vulnerability in fully patched Windows 11 systems that allows attackers to install custom rootkits, which can bypass endpoint security and maintain persistence on compromised systems. This vulnerability is linked to a downgrade attack technique demonstrated by SafeBreach researcher Alon Leviev at Black Hat USA 2024, using an exploit tool called Windows Downdate. This tool enables an attacker with administrative access to manipulate the Windows Update process, reverting patched components to vulnerable states. Leviev's demonstration showed that even systems using virtualization-based security (VBS) are at risk, as he could downgrade VBS features and expose previously fixed privilege escalation vulnerabilities. Microsoft has patched two vulnerabilities (CVE-2024-21302 and CVE-2024-38202) but has not addressed the core issue of the downgrade capability. Microsoft maintains that the ability for an admin-level user to gain kernel code execution does not cross a security boundary. Leviev released details of a new downgrade attack on October 26, using the Windows Downdate tool to revive a driver signature enforcement bypass attack. He categorized this flaw as False File Immutability (FFI), exploiting incorrect assumptions about file immutability. He noted that downgrading specific OS modules, like CI.dll, allows exploitation even with VBS enabled. Tim Peck from Securonix highlighted that the attacks exploit Windows' failure to validate DLL version numbers properly, enabling the use of outdated, vulnerable files. Microsoft is actively developing mitigations against these risks, including a security update to revoke outdated VBS system files, although specific measures and timelines are not yet disclosed.
Leaked Wallpaper Exploit Let Attackers Escalate Privilege on Windows Systems
Winsage
August 5, 2024

Leaked Wallpaper Exploit Let Attackers Escalate Privilege on Windows Systems

A security vulnerability, tracked as CVE-2024-38100 and referred to as "FakePotato," has been identified in the wallpaper handling mechanism of Windows, potentially allowing attackers to gain system-level privileges. This flaw affects multiple versions of Windows, including Windows 10 and Windows Server 2016, 2019, and 2022. The vulnerability has a CVSS v3.x base score of 7.8, indicating high severity. A proof-of-concept exploit demonstrates how an attacker can escalate privileges and access sensitive user information by manipulating Windows File Explorer to connect to a malicious SMB share. Microsoft has released a security update (KB5040434) to address this vulnerability, and users are advised to apply it promptly. Security measures recommended include regular updates, implementing the principle of least privilege, monitoring for suspicious activities, and utilizing strong authentication methods.
silver Android smartphone
Winsage
June 13, 2024

Black Basta ransomware gang linked to Windows zero-day attacks

Symantec uncovered an attempted ransomware attack by the Black Basta gang, who exploited CVE-2024-26169, a Windows privilege escalation vulnerability, to gain unauthorized access to compromised systems. The exploit tool targeted a flaw in the Windows Error Reporting Service to escalate access, with one variant having a compilation timestamp predating Microsoft's fix. Black Basta's history of leveraging Windows tools and deep understanding of the platform make them a formidable cybersecurity threat. Organizations should apply the latest Windows security updates and follow CISA guidelines to protect against potential attacks.
Search