3 ms·

Wow. Is this really as bad as it sounds? I'm no security researcher but this sounds quite bad: "AtomBombing is performed just by using the underlying Windows m

by saganus 10y ago

Wow. Is this really as bad as it sounds? I'm no security researcher but this sounds quite bad: "AtomBombing is performed just by using the underlying Windows mechanisms. There is no need to exploit operating system bugs or vulnerabilities. Since the issue cannot be fixed, there is no notion of a patch for this" I'm guessing that if this starts to be a popular attack vector, security firms would try to come up with some sort of atom integrity checker or something, but still, this doesn't look good. Or am I missing something and maybe it's really not that bad? any one has any resources to read up more on atoms (besides the research paper)?

cm3 10y ago
Windows Atom Tables are nothing special and are, like many APIs invented for other features, very old. Think using lookup for DLLs in the same dir as the program or autorun.ini as similar old feature that were abused as attack vectors. https://msdn.microsoft.com/en-us/library/windows/desktop/ms649053(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms6...
red75prime 10y ago
If you have an active virus on your system, it can use this method (or any other already known method) to inject its code into, say, your browser and steal credit card info or some such. Nothing new, but a few new tricks.
XaYdEk 10y ago
It's a code injection method. And it's an interesting approach, but dll injection with some tricks can be just as undetectable. Short version: An attacker already has unprivileged access to your machine (running something with your user's privilege level). The attacker can use this type of method to access other processes in the same security context (running under the same user). Or in different terms: it's not privilege escalation, it's not remote code injection (because you already need to be in), it's a method for increasing horizontal access. So no, the sky is not falling or not more than usual. :)

by saganus 10y ago

cm3 10y ago

Windows Atom Tables are nothing special and are, like many APIs invented for other features, very old. Think using lookup for DLLs in the same dir as the program or autorun.ini as similar old feature that were abused as attack vectors. https://msdn.microsoft.com/en-us/library/windows/desktop/ms649053(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms6...

red75prime 10y ago

If you have an active virus on your system, it can use this method (or any other already known method) to inject its code into, say, your browser and steal credit card info or some such. Nothing new, but a few new tricks.

XaYdEk 10y ago

It's a code injection method. And it's an interesting approach, but dll injection with some tricks can be just as undetectable. Short version: An attacker already has unprivileged access to your machine (running something with your user's privilege level). The attacker can use this type of method to access other processes in the same security context (running under the same user). Or in different terms: it's not privilege escalation, it's not remote code injection (because you already need to be in), it's a method for increasing horizontal access. So no, the sky is not falling or not more than usual. :)