Thursday, March 28, 2024

400 Million Windows Computer Vulnerable to “Bashware” Security Software Bypass Attack

A New Attacking Technique called “Bashware” can able to Bypass all Windows Based Security Software solutions by abusing the New Windows 10 Future called Windows Subsystem for Linux (WSL) and Injecting the Backdoor.

WSL is Compatibility Layer for running Linux binary executable on Windows 10 based Computers that helps to Enable the bash terminal available for Windows OS users.

This Flow can able to allow any Malware’s to bypass the Advanced security solutions, Next Generation Anti Virus software, inspection tools, Anti-Ransomware solutions.

This means that Bashware may potentially affect any of the 400 million computers currently running Windows 10 PC globally.

Also Read :  Vault 7 Leaks: CIA Hacking Tool “Angelfire” Secret Document Revealed to Compromise WindowsOS – WikiLeaks

How Does it Bypass the security Futures

Presently Available security software Futures is not that much Effectively Monitoring the processes of Linux Executable’s running on Windows OS.

This will leads to open a backdoor to the hackers and run their Malicious code by abusing the  WSL futures which allow hiding from the current intelligence that is given by the security vendors.

Bashware Technique Mainly abusing the “Netcat” utility Futures that is used for reading and writing to network connections using TCP or UDP.

Netcat has some list of Futures including port scanning, transferring files, and port listening, and also it can be used as a backdoor.

In some case, Security Software like Anti-Virus is not allowed the Netcat Futures to get Executed.

By Default, 1337 port is closed because it leads to create a Backdoor and allow the Trojan services to run on the Windows Computers.

Once Bashware Execute the Malware, then it will Bypass all the security solutions and it will later Enable the WSL Future.

https://www.youtube.com/watch?v=4ki6dbEePaw&feature=youtu.be

End of the Execution will Successfully open the Netcat Listener port(1337) that will helps to Attackers to Open a Backdoor.

Windows Inspection Tools such as Task Manager will not Identify the Malicious Payload Process. Instead of that, it can only show the WSL Loader process.

Advanced Process Monitoring Tool also not Detecting the Malicious Payload Process which is Running behind of the WSL Process.

According to Checkpoint Software, a hybrid concept which allows a combination of Linux and Windows systems to run at the same time but allow them to use the features provided by WSL to hide from security products that have not yet integrated the proper detection mechanisms

Security industry to take immediate action and to modify their security solutions to protect against this new method to Mitigate this Actives. Checkpoint Said.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles