Researchers Demonstrate How EDR and Antivirus Can Be Weaponized Against Users

Dec 12, 2022Ravie LakshmananEndpoint Detection / Data Security

High-severity security vulnerabilities have been disclosed in
different endpoint detection and response (EDR) and antivirus (AV)
products that could be exploited to turn them into data wipers.

“This wiper runs with the permissions of an unprivileged user
yet has the ability to wipe almost any file on a system, including
system files, and make a computer completely unbootable,”
SafeBreach Labs researcher Or Yair said^[1]. “It does all that
without implementing code that touches the target files, making it
fully undetectable.”

EDR software, by design, are capable of continually scanning a
machine for potentially suspicious and malicious files, and taking
appropriate action, such as deleting or quarantining them.

The idea, in a nutshell, is to trick vulnerable security
products into deleting legitimate files and directories on the
system and render the machine inoperable by making use of specially
crafted paths.

This is achieved by taking advantage of what’s called a junction point^[2]
(aka soft link), where a directory serves as an alias to another
directory on the computer.

Put differently, between the window the EDR software identifies
a file as malicious and attempts to delete the file from the
system, the attacker uses a junction to point the software towards
a different path, like C:\ drive.

The approach, however, didn’t result in a wipe as EDRs prevented
further access to a file after it was flagged as malicious. What’s
more, should the rogue file be deleted by the user, the software
was clever enough to detect the deletion and stop itself from
acting on it.

The ultimate solution arrived in the form of a wiper tool,
dubbed Aikido^[3], that triggers the
privileged delete by creating a malicious file at a decoy directory
and not granting it any permission, causing the EDRs to postpone
the delete until next reboot.

Given this new attack interval, all an adversary has to do is
delete the directory containing the rogue file, create a junction
to point to the target directory to be deleted, and reboot the
system.

Successful weaponization of the technique could result in the
deletion of system files like drivers, preventing the operating
system from booting. It can also be abused to remove all files from
administrator user directories.

Out of 11 security products that were tested, six were found
vulnerable to the zero-day wiper exploit, prompting the vendors to
release updates to address the shortcoming –

“The wiper executes its malicious actions using the most trusted
entity on the system — the EDR or AV,” Yair said. “EDRs and AVs do
not prevent themselves from deleting files.”