How Do User-Land and BIOS Security Bypasses Work?

TL;DR

User-land security hooks can be removed because malicious processes can access the same hooked code as antivirus and EDR products. The demonstrations also show how a Raspberry Pi network adapter can redirect unencrypted browser traffic on a locked computer, and how a compromised BIOS update process can overwrite firmware, gain deep persistence, or prevent a system from booting.

Transcript

Let's just get rolling. Captain Unhook or how to bypass everything, literally. Um, antivirus, e-- enterprise detect and response solutions, visibility solutions, forensic solutions, signatures, whitelisting, blacklisting, all kinds of stuff. Now, it's not every single product, but it's pretty darn close out there, okay? Anything that tries to hook ... Read More

Key Insights

• User-land hooks are accessible to malicious processes because security products and hostile code operate within the same user-space environment. This shared access allows an attacker-controlled process to inspect, modify, or remove hooks used by antivirus, EDR, visibility, filtering, and process-monitoring products.
• Captain Unhook works by examining every module loaded into a process, opening the associated files, and obtaining clean representations of the DLLs. It then compares non-writable sections in memory with those clean versions and restores any section whose contents do not match.
• Patch Guard on 64-bit Windows restricted many forms of kernel hooking and pushed security providers toward user-land instrumentation. The transcript notes limited exceptions, including object register callback functions, but argues that increased kernel notification callbacks would give defenders stronger monitoring and control.
• The browser exploitation demonstration uses a vulnerable Internet Explorer generic element use-after-free flaw to execute the unhooking code. After the browser visits the attacker-controlled Metasploit server, the exploit downloads and runs the payload, after which the demonstration launches the Windows calculator application.
• PoisonTap works by presenting a Raspberry Pi Zero to Windows as a new network adapter. The computer issues a DHCP request, the device becomes the network gateway, and traffic is routed through the Raspberry Pi before continuing through the machine's normal network interface.
• Unencrypted browser refreshes create an injection opportunity because the demonstrated Raspberry Pi cannot inspect the SSL session. When a non-SSL page automatically refreshes, the device injects JavaScript that retrieves a Metasploit exploit and then downloads and executes modified ransomware.
• BIOS compromise provides a high level of persistence because BIOS updates are infrequent and difficult to modify or repair. The demonstrated attack uses a legitimate updater from the BIOS manufacturer to replace the installed firmware with an attacker-controlled BIOS image.
• The BIOS ransomware chain bypasses code signing, installs a kernel-mode payload, executes an SMM exploit, elevates privileges, and writes the malicious firmware. During reboot, the infected DXE driver receives control and blocks startup, leaving the targeted computer unable to boot.

Questions & Answers

Q: How does Captain Unhook remove user-land security hooks?

Captain Unhook enumerates the modules loaded into a process and opens their corresponding files to obtain clean versions of the DLL data. For each section that is not writable, it compares the clean file-backed content with the version currently loaded in memory. When the two versions differ, it replaces the altered in-memory content with the clean content, effectively removing the hook.

Q: Why are user-land security hooks vulnerable to bypass?

User-land security hooks are vulnerable because malicious processes can access the same user-space environment in which antivirus, EDR, visibility, URL-filtering, and process-monitoring products place their hooks. An attacker can therefore inspect those modifications and restore hooked DLL sections from clean files. The presentation argues that defenses relying on user-land hooking cannot assume their instrumentation is protected from hostile processes.

Q: How did Patch Guard affect security product monitoring?

Patch Guard on 64-bit Windows prevented most of the kernel-hooking approaches that products previously used, although the presentation mentions some exceptions, including object register callback functions. This restriction pushed antivirus, EDR, and related security providers toward user-land hooks for functions such as URL tracking, filtering, HIPS, process-memory observation, and module-load monitoring, exposing those hooks to malicious user-land processes.

Q: How was the Captain Unhook proof of concept delivered?

The proof of concept used Metasploit and a browser exploit targeting an Internet Explorer generic element use-after-free vulnerability. The vulnerable system opened a link to the attacker's Metasploit server and port. The exploit then executed through the browser, downloaded the unhooking code, and ran it. The demonstration launched the calculator application, while noting that other payloads could have been substituted.

Q: How can PoisonTap attack a computer while it is locked?

The demonstrated PoisonTap-style device is connected while the computer is locked, but Windows still recognizes it as a new network adapter and makes a DHCP request. The Raspberry Pi becomes the gateway for network traffic. An already open, non-SSL browser page later refreshes automatically, receives injected JavaScript from the device, and triggers an exploit that downloads and executes modified ransomware.

Q: Why does the PoisonTap demonstration depend on non-SSL traffic?

The Raspberry Pi can redirect traffic because it becomes the Windows machine's network gateway, but the presenters state that their demonstration cannot peer into an SSL session. It therefore relies on a browser page that is not using SSL. When that page refreshes, the device can alter the traffic, inject JavaScript, retrieve the Metasploit exploit, and start the subsequent payload-download process.

Q: How does the demonstrated BIOS ransomware attack work?

The attack begins with a malicious email containing a Word document with an embedded PowerShell dropper. After the document and script execute, PowerShell downloads the BIOS manufacturer's own updating tool. The attack bypasses code signing, installs a kernel-mode payload, uses an SMM exploit, elevates privileges, and employs the updater to overwrite the existing BIOS with a modified version.

Q: Why is a BIOS compromise difficult to recover from?

A BIOS compromise is difficult to recover from because BIOS updates are infrequent, hard to obtain, and difficult to change or modify, according to the presentation. That makes firmware an attractive location for persistent malicious code. In the demonstrated destructive scenario, the modified BIOS contains an infected DXE driver that gains control during reboot and blocks the system from booting.

Summary & Key Takeaways

• Security products commonly place hooks in user-land processes because Patch Guard limited many kernel-hooking techniques on 64-bit Windows. Captain Unhook examines loaded modules, opens the corresponding files to obtain clean DLL data, compares non-writable sections against memory, and replaces altered sections, thereby removing detected hooks before executing another payload.

• The PoisonTap demonstration uses a Raspberry Pi Zero that Windows recognizes as a network adapter. After receiving a DHCP request, the device becomes the network gateway and redirects traffic through itself. When an existing non-SSL browser page refreshes, injected JavaScript triggers an exploit that downloads and runs modified ransomware while the computer remains locked.

• The BIOS demonstration targets an updated Windows 10 system with Secure Boot, Device Guard, and Virtual Secure Mode active. A malicious document invokes a PowerShell dropper, downloads a manufacturer BIOS updater, bypasses code signing, installs a kernel-mode payload, and flashes a modified BIOS whose infected DXE driver blocks the next boot.