Wave Systems Corp. (fka WAVXQ)

[Genz2]

Researcher finds simple way of backdooring Windows PCs and nobody notices for ten months

https://www.zdnet.com/article/researcher-finds-simple-way-of-backdooring-windows-pcs-and-nobody-notices-for-ten-months/

"RID Hijacking" technique lets hackers assign admin rights to guest and other low-level accounts.

A security researcher from Colombia has found a way of assigning admin rights and gaining boot persistence on Windows PCs that's simple to execute and hard to stop --all the features that hackers and malware authors are looking for from an exploitation technique.

What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns.

Discovered by Sebastián Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID).

The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts.

Castro, with help from CSL CEO Pedro García, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group.

The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password.

But in cases where a hacker has a foothold on a system --via either malware or by brute-forcing an account with a weak password-- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.

Since registry keys are also boot persistent, any modifications made to an account's RID remain permanent, or until fixed.

The attack is also very reliable, being tested and found to be working on Windows versions going from XP to 10 and from Server 2003 to Server 2016, although even older versions should be vulnerable, at least in theory.

"It is not so easy to detect when exploited, because this attack could be deployed by using OS resources without triggering any alert to the victim," Castro told ZDNet in an interview last week.

"On the other hand, I think is easy to spot when doing forensics operations, but you need to know where to look at.

"It is possible to find out if a computer has been a victim of RID hijacking by looking inside the [Windows] registry and checking for inconsistencies on the SAM [Security Account Manager]," Castro added.

A dead giveaway is if a guest account's SID ends with a "500" RID, a clear hint the guest account has admin rights and that someone has tampered with the registry keys.

The CSL researcher has created and released a module for the Metasploit Framework that automates the attack, for pen-testing purposes.

"We reached out Microsoft as soon as the module was developed, but we did not receive any kind of response from them," Castro told us. "And no, it is not already patched."

It is unclear why Microsoft hasn't responded, but the researcher has been on a tour this summer, presenting his findings at various cyber-security conferences, such as Sec-T, RomHack, and DerbyCon. A video of his most recent presentation is embedded below.

"As far as I know, there was no internet documentation about this particular attack when I published the blog describing it," Castro told ZDNet. "Since this is a simple technique, I do not think that only my company and I knew about this."

But while some clever hacks like the one Castro has documented have been known to slip through and get no media coverage, they often don't go unnoticed by malware authors.

RID hijacking is simple, stealthy, and persistent --just what hackers like most about Windows flaws. But in this case, RID hijacking appears to have slipped by malware authors as well.

"I am not aware of any malware using this persistence technique," Castro told us. "I asked some malware analysts about it, but they told me they have not seen this implemented on malware."
==================================================================
Trivial Post-Intrusion Attack Exploits Windows RID

https://threatpost.com/trivial-post-intrusion-attack-exploits-windows-rid/138448/


Simple technique enables attackers to leverage Windows OS component to maintain stealth and persistence post system compromise.


An novel post-intrusion attack technique allows hackers to hijack a Windows system component called RID, allowing the adversaries to assign administrative privileges to “guest” and other low-level accounts.

The technique is simple and does not require a lot of sophistication, security researcher Sebastian Castro, who discovered the hack, told Threatpost. Microsoft was notified of the attack technique when it was discovered almost a year ago – and has yet to offer a fix, the researcher said.

“We have discovered and created a new post-exploitation technique called RID Hijacking,” Castro said in a recent blog post. “By using only OS resources, it is possible to hijack the RID of any existing account on the victim (even the 500 Administrator Built-in Account), and assign it to another user account.”

The attack starts in the Relative Identifier (RID), a component in Windows user accounts. RIDs are a label as part of Security Account Managers (SAMs), which describe a user’s varying permissions. SAMs typically have RID code at the end to define user permissions.

Two common RIDs in particular are the focus of the attack: the number 500 is commonly used at the end of SAMs for an Admin account, while 501 is used for a Guest Account.

The hijacking technique effectively manipulates the registry keys storing this information, and modifies the RID with accounts. So, the 501 labeling a guest account would be changed to 500, indicating permissions of an administrator.

“After compromising a machine, it is possible to automatize this attack remotely via PSExec, Remote Desktop, Powershell and also by using offensive tools like Metasploit,” Castro told Threatpost. “Since this is a persistence technique and not a privilege escalation vector, it is necessary to have elevated privileges already to deploy the attack.”

The Metasploit software to automatize the attack requires a meterpreter session against the victim – the module for this can be found at the latest official release of the MSF framework at post/windows/manage/rid_hijack, Castro said.

The attack was tested on Windows XP, Windows Server 2003, Windows 8.1 and Windows 10.

The attack does come with drawbacks – it cannot be done remotely (unless the computer is left unprotected on the internet). However, once a system has been exploited, it is difficult to detect.

“It is possible to find out if a computer has been victim of the RID Hijacking attack by looking inside the registry and checking for inconsistencies on the SAM,” he told us. “On the other hand, it is not so easy to detect right when exploited, because this
attack could be deployed by using OS resources without triggering any alert on the victim.”

Castro said he reached out Microsoft as soon as the module was developed in December 2017, but did not receive any kind of response from them.

Microsoft, for its part, told Threatpost that it is looking into the report.

“Microsoft has a strong commitment to security and a demonstrated track record of investigating and resolving reported vulnerabilities,” Jeff Jones, senior director at Microsoft, told Threatpost. “We’re looking into this report, and if we determine we need to take further action to help keep customers protected, we will.?”
==================================================================
This RID hijacking could be a potential problem for many companies as Microsoft has not offered a solution in almost a year. This persistent technique requires elevated privileges and they are needed to deploy the hijack. Wave VSC 2.0 could prevent the attacker from using a computer by not allowing the attacker to use a computer with these privileges. The attacker would have to have the computer (TPM) and the PIN number to deploy the attack and that is obviously much more difficult than a password or other 2FA product that has weaknesses.

https://www.wavesys.com/sales - The source for an excellent product like Wave VSC 2.0 to alleviate a potentially bad problem for companies that own Windows PCs.

https://www.wavesys.com/products/wave-virtual-smart-card