Skip to main content

A New Windows 10 Zero Day Exploit Allows Attackers to Cause a System Crash Released On GitHub

A New Windows 10 Zero Day Exploit Allows Attackers to Cause a System Crash Released On GitHub

If your Windows 10 run PC or laptop is crashing suddenly, somebody is using a Windows 10 zero-day against it. The exploit was released in the wild on Github allowing anybody with technical knowledge to crash thousands of Windows 10 run PCs and laptops with a BSOD screen.
The Zero-day was discovered by a researcher that goes by PythonResponder on Twitter, and who published proof-of-exploit code for it on GitHub on Wednesday.

How this Windows 10 zero-day works:

The Windows 10 zero-day discovered by PythonResponder is actually a memory corruption bug in the handling of SMB traffic that could be easily exploited by forcing a Windows system to connect to a malicious SMB share. However, to exploit the bug, a potential hacker has to trick a Windows 10 user into clicking a phishing link containing the exploit. Considering how easy it is to socially engineer such links, the zero-day could turn out to be quite effective.
The severeness of the bug has been noted by Carnegie Mellon’s Vulnerability Notes Database which has a new alert up for an exploit that can allow a remote attacker to crash a Windows 10 machine.
The vulnerability is yet to be patched by Microsoft and works on Windows 7/8.1 and Windows 10. The researcher says that he shared knowledge of the flaw with Microsoft, and claims that “they had a patch ready 3 months ago but decided to push it back.” Supposedly, the patch will be released next Tuesday.

Proof-of-concept

Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a specially-crafted server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. We have confirmed the crash with fully-patched Windows 10 and Windows 8.1 client systems, as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2.
The PoC exploit has been tested by SANS ISC CTO Johannes Ullrich, and works on a fully patched Windows 10. You can read his full report here.
While this particular Windows 10 zero-day requires the hacker to create a malicious link containing the exploit, Windows 10 failure to correctly handle the SMB traffic means that somebody could discover a way to exploit it without user interaction/malicious link.

Mitigation

The only safe way for Windows 7/8.1 and Windows 10 PC/laptop owners to prevent this bug from being used against them is to avoid untrusted links. System administrators can prevent it from being exploited by blocking outbound SMB connections (TCP ports 139 and 445, UDP ports 137 and 138) from the local network to the WAN, as advised by CERT/CC. They should know that blocking this ports could also prevent users from accessing shared files, data, or devices.
Microsoft is believed to have accorded top priority to this Windows 10 zero-day and will release the patch this coming Tuesday.

Popular posts from this blog

Hidden Wiki

Welcome to The Hidden WikiNew hidden wiki url 2015 http://zqktlwi4fecvo6ri.onion Add it to bookmarks and spread it!!!
Editor's picks Bored? Pick a random page from the article index and replace one of these slots with it.
The Matrix - Very nice to read. How to Exit the Matrix - Learn how to Protect yourself and your rights, online and off. Verifying PGP signatures - A short and simple how-to guide. In Praise Of Hawala - Anonymous informal value transfer system. Volunteer Here are five different things that you can help us out with.
Plunder other hidden service lists for links and place them here! File the SnapBBSIndex links wherever they go. Set external links to HTTPS where available, good certificate, and same content. Care to start recording onionland's history? Check out Onionland's Museum Perform Dead Services Duties. Introduction PointsAhmia.fi - Clearnet search engine for Tor Hidden Services (allows you to add new sites to its database). DuckDuckGo - A Hidden S…

[SOLVED] IDM WAS REGISTERED WITH A FAKE SERIAL NUMBER

[SOLVED] IDM WAS REGISTERED WITH A FAKE SERIAL NUMBER
Good News [May 08, 2015]: IDM developers got smarter, but the crackers are always a step ahead. Follow this article and send an email to uglyduckblog@gmail.com if you are desperate. I can NOT post any crack here for legal reasons. Happy Downloading with IDM. ;) *********** first tip is to use latest crack for idm from  onhax.net idm universal web crack and make sure u are using all latest vers I am sure many of us are too much dependent on Internet Download Manager a.k.a. IDM. The main reason didn’t permanently switch to linux was IDM. I mainly use it for batch downloading and download streaming videos. Till yesterday, IDM was working fine with me (of course with fake serial numbers, keygen, crack, patch etc. which could be found with little effort). But few days ago, with the latest update version 6.18 build 7 (released on Nov 09, 2013) Internet Download Manager was literally had a breakthrough and crushed all the serial numbers, …

DoubleAgent Attack Turns Your Antivirus Into Malware And Hijacks Your PC



Short Bytes: Cybellum security researchers have uncovered a new attack mechanism that can be used to take control of your antivirus and turn it into a malware. Called DoubleAgent, this attack exploits an old and undocumented vulnerability in Windows operating system. This Zero Day code injection technique affects all major antivirus vendors and has the power to hijack permissions. The security researchers from Cybellum have found a new technique that can be used by the cybercriminals to hijack your computer by injecting malicious code. This new Zero-Day attack can be used to take full control over all the major antivirus software. Instead of hiding from the antivirus, this attack takes control of the antivirus itself. Called DoubleAgent, this attack makes use of a 15-year-old legitimate feature of Windows (read vulnerability)–that’s why it can’t be patched. It affects all versions of Microsoft Windows. Cybellum blog mentions that this flaw is still unpatched by most antivirus v…