Cisco has tested Cisco Security Agent and has confirmed that default policies are capable of detecting attacks of this type as rootkit activity and blocking them as appropriate.
Description
A security research team has created a tool that is able to bypass security software protections provided by host-based security software on Windows systems and execute arbitrary code with kernel privileges.
The vulnerability is due to an error in the handling of System Service Descriptor Table (SSDT) protections used by many security applications. These SSDT protections are designed to prevent an attacker from accessing kernel mode software.
However, if an attacker can beat a race condition, the attacker may be able to bypass the SSDT protections and execute arbitrary code in kernel mode. The attack functions by racing the time-of-check, time-of-use (TOCTOU) window. The SSDT handles routines that transition from user-mode privileges to kernel-mode privileges. Many types of desktop security software use hooks to modify addresses stored in the SSDT. Prior to allowing a call to execute, the software will check that the address listed in the table is something that should be trusted and, if not, will block execution.
If an attacker can race the security software's protection mechanism and change the address value of an entry in the SSDT that has been checked and verified as acceptable before that entry is executed, the attacker could bypass protection mechanisms. Thus, at the time of check, the address listed in the SSDT is acceptable and deemed safe; at the time of use, the address has been changed to that of a malicious routine and is not safe.
Because of the way the SSDTs are implemented, exploitation is easier on multiprocessor systems than on single processor systems. The research team has created a tool called Kernel Hook Bypassing Engine (KHOBE) that automates the exploit.
Cisco Security Intelligence Operations has tested Cisco Security Agent 6.0.2 to verify that, using default policies, TOCTOU attacks can be flagged as rootkit activity and would prompt the user to allow or deny action. When the user denies the activity, system compromise is mitigated. However, users who allow the rootkit activity could bypass Cisco Security Agent protections. The behavior is documented in Cisco bug ID CSCtg69000.
Based on the characteristics of this vulnerability, Cisco expects that Cisco Security Agent will prevent similar exploit attempts as well. During testing, the following rules from the Security-Rootkits module in the Anti-Rootkit Policy were triggered:
All hashes and codes modify kernel functionality Set Rootkit detected as Untrusted, all hashes and codes modify kernel functionality
The triggering of these rules could isolate the targeted system or block the malicious activity.
Note that 64-bit Windows systems may be less susceptible because of a Windows Kernel Patch Protection mechanism called PatchGuard.
Alert History
Version 1, May 6, 2010, 11:25 AM: A security research team has created a tool that is able to bypass security software protections and execute arbitrary code with kernel privileges. Updates are not available.
The security vulnerability applies to the following combinations of products.
Primary Products:
IntelliShield
Security Activity Bulletin
Original Release Base
Associated Products:
Cisco
Cisco Security Agent
6.0 .2
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment. Cisco is pleased to offer a free trial of the service.
To register for full access, please visit the IntelliShield trial registration page.
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
