Hackers Can Inject Malicious Code into Antivirus Processes to Create a Backdoor
A recent technique enables attackers to exploit antivirus software by injecting harmful code directly into antivirus processes. This method allows evasion of detection and compromises the intended security protection.
A recent technique enables attackers to exploit antivirus software by injecting harmful code directly into antivirus processes. This method allows evasion of detection and compromises the intended security protection.
This technique, detailed by cybersecurity researcher Two Seven One Three, involves cloning protected services and hijacking cryptographic providers to create a backdoor in the antivirus installation folder. This method bypasses standard defenses and highlights vulnerabilities in how antivirus solutions prioritize stability.
Antivirus software employs several strategies to protect core processes from interference, ensuring user protection. These programs generally run with SYSTEM-level privileges, granting broad access to monitor and neutralize threats.
Process introspection allows antivirus software to scan its own threads for unauthorized code injections. Additional safeguards include code integrity checks and the use of Windows' Protected Process Light (PPL) feature, which isolates user-mode processes to prevent tampering. Kernel drivers deploy sensors to block detection mechanism alterations, and self-protection routines automatically restart compromised components or alert on suspicious activity.
The protection process involves meticulous qualification, avoiding simplistic checks like process names, which attackers could spoof. Solutions like Bitdefender verify the process's ImagePath and restrict file writes to installation folders, adding another layer of security with digital signatures of loaded DLLs.
A recent technique enables attackers to exploit antivirus software by injecting harmful code directly into antivirus processes.
The technique exploits the antivirus's reliance on operating system features while targeting less-guarded auxiliary components. Modern antivirus suites bundle extras like firewalls, VPNs, and user interfaces, each running protected processes with installation folder write access. Since direct termination is blocked short of kernel exploits, cloning is used.
By exporting and importing registry keys for an antivirus service, a duplicate service can be created with identical configurations. A system reboot loads this clone into Services.exe's cache, spawning a new protected process.
Injection occurs by hijacking the Windows Cryptography API, which antivirus processes use for encryption and signing. Modifying the registry key to point to a malicious DLL triggers its loading during service startup. The DLL is signed using cloned certificates from legitimate Windows programs to evade signature checks.
IAmAntimalware: A Tool for Testing and Evasion
The process is automated with IAmAntimalware, an open-source tool by Two Seven One Three available on GitHub. It clones services, modifies cryptographic providers or COM objects, imports certificates, and starts the duplication process with specified command-line parameters.
In tests with Bitdefender, the tool successfully injected a sample DLL signed using CertClone, another GitHub utility. The implications are significant, as malware could embed backdoors in antivirus environments, executing undetected.
Prevention requires vigilant monitoring of module loads from anomalous paths, auditing trusted certificates in the registry, and enforcing PPL alongside behavioral analytics. Such disclosures push antivirus vendors to strengthen their defenses.
Based on reporting by Cyber Security News.