SignDrop is a Windows CLFS privilege-escalation issue: under specific conditions, a standard user could obtain SYSTEM privileges.
The published proof of concept relies on the creation of.cnpf helper files.
It requires CLFS authentication mode 0 or 1 and the Defender service to be enabled; researchers say the method works but is unstable.
Microsoft has not confirmed the issue or released a fix.
How does the problem arise?
Researcher MSNightmare has published the code for a test attack that exploits the way a computer creates certain utility files. Specifically, the method uses the permissions of the Windows security service (Defender) that runs in the background to create these files in places that a normal user should not normally have access to. For this process to work, the Defender service must be enabled, as well as certain security settings on the system.
Which systems are affected?
The issue affects computers with CLFS authentication enabled in mode 0 or 1. Researchers from 78researchlab confirmed that the attack method does indeed work, although they noted that it is unstable and can cause problems with the computer's operation. This means that such an action would be easily detected by the user.
Microsoft's stance and the risk
So far, Microsoft has not confirmed the issue, nor has it released any update to fix it. Furthermore, there are no reports that this vulnerability has been used in actual attacks by third parties. Users can check their system's security settings for the CLFS mechanism through the Windows registry.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)