SMBdoor: A security researcher created a new backdoor inspired by NSA's malicious software leaked in the spring of 2017.
The new malware is called SMBdoor and is the work of researcher Sean Dillon better safetyof RiskSence (@zerosum0x0).
Dillon designed SMBdoor as a Windows kernel driver, which once installed on a computer, captures APIs that are not registered in the srvnet.sys process to register as a valid process for Server Message Block (SMB) connections.
The malware is unbelievable as it does not connect to local sockets, open ports and does not rely on existing functions, thereby avoiding triggering alerts from anti-virus systems.
Η σχεδίασή του ήταν εμπνευσμένη από μια παρόμοια συμπεριφορά που παρατήρησε ο Dillon στα DoublePulsar και DarkPulsar, δύο εμφυτεύματα κακόβουλου λογισμικού σχεδιασμένα από την NSA που διέρρευσαν στο διαδίκτυο από την hacking team The Shadow Brokers.
However, some users may be wondering (and rightly so): Why did a security researcher create malware?
Dillon told ZDNet that the SMBdoor code is not armed and that cybercriminals can not download it from GitHub to infect users in the same way they can download and develop versions of the NSA DoublePulsar.
Let us also mention that each PoC that is circulated by researchers is recorded and analyzed by security companies and security software providers as well as by PoC software developers /
"SMBdoor comes with practical limitations that make it mostly academic research, but I thought it would be interesting to share it."
There are restrictions on PoC that an intruder must overcome, ”he added. "The most important limitation is that modern Windows tries to block the core code without a valid digital signature.
___________________
- Windows Sandbox enable in Windows 10 Home
- Ubuntu 18.10 upgrade to Ubuntu 19.04 Disco Dingo
- Bloatware; automatic removal from Windows 10
- Windows 10 May 2019 Update delay the upgrade