Security News How I ruined my vacation by reverse engineering WSC (Windows Security Center)

[SeriousHoax]

Content source

https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/

In this post I will briefly describe the journey I went through while implementing defendnot.

Even though this is most likely not what you expected to see here, but rather than going into full technical details on how everything works, I will describe what rabbitholes I went through and how painful everything was due to my special environment.

Beware, most likely this post will be too informal unlike the previous posts of mine, pretty sure all the other posts with irl tag will be written in a style like this. If you are looking for a more detailed technical description of how everything works, a writeup like this will be released a bit later by someone else and I will link it here.

A one-year step back​

Almost exactly one year ago I released a tool no-defender, a project that was disabling windows defender using the special windows api made for antiviruses to let the system know that there is an another antivirus so there is no need to run defender scans.

The part of the system that manages all this mess is called Windows Security Center - WSC for short. The way how it worked is that it was using a thirdparty code from some already existing antivirus and forced it to register the antivirus without having anything else installed.

Then after a few weeks after the release, the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filled a DMCA takedown request and I didn’t really want to do anything with that so just erased everything and called a day.

How it started​

Currently, even while writing this article, I am sitting in an airbnb we rented in Seoul. After numerous trips to other parts of the planet for CTFs and stuff, me and a friend of mine decided that we want to visit Seoul and arrived a few months after that.

My current main machine for non-ctf things is an M4Pro MacBook and usually, when I am going for a CTF I bring an another x86 laptop with me to do some extensive reverse engineering/pwn stuff as it is usually built for the x86 cpus, emulation would kind of work for this task but it is pretty painful so I just use an another laptop for all the x86 stuff.

And, as you might have guessed, for this trip I did not bring that x86 laptop with me, but I did bring my macbook with me to do some other development stuff in my free-free time.

And, on May 4th, after a few days spent in South Korea meeting my favorite South Korean CTF friends and drinking alcohol with them, I received a message from MrBruh where they said that they were looking at no-defender and were looking into whether it would be possible to create a “clean” implementation of my project without using any AVs.

Initial research (Day 1)​

I am having some troubles with my sleep schedule and I woke up a bit earlier than my friends so I decided to take a look at this while I am waiting for my friends to wake up.

MrBruh provided me the latest binaries of wsc because I was too lazy to spin up my parallels vm to get the binaries and I started looking into what we got.

As a reference implementation, I took the WSC registration implementation made by the same AV I was using a year ago. I was somewhat familiar with the internals of their thing and it was a great call.

Essentially, WSC has a COM API that all antiviruses are using, so I quickly rebuilt everything that AV was doing with it in ~1hr, booted an arm64 windows in parallels and tested the thing. I was greeted with an access denied error.

But from my last year’s courtesy I knew that WSC was
somehow validating the process that calls these APIs, my guess was that they are validating the signatures, which was indeed a correct guess but I didn’t know that for sure at that time. My move then was to...........................................

Full blog post:

How I ruined my vacation by reverse engineering WSC

In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly. Even though this is most likely not what you expected to see here, but rather than going into full...

blog.es3n1n.eu

 

[bazang]

Full blog post:

How I ruined my vacation by reverse engineering WSC

In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly. Even though this is most likely not what you expected to see here, but rather than going into full...

blog.es3n1n.eu

Will be used by threat actors to bork Defender. Wait for it... in the daily cybersecurity click-bait news.

 

[Parkinsond]

A new tool called 'Defendnot' can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.
The trick utilizes an undocumented Windows Security Center (WSC) API that antivirus software uses to tell Windows it is installed and is now managing the real-time protection for the device.

Normally, WSC API is safeguarded through Protected Process Light (PPL), valid digital signatures, and other features.
To bypass these requirements, Defendnot injects its DLL into a system process, Taskmgr.exe, that is signed and already trusted by Microsoft. From within that process, it can register the dummy antivirus with a spoofed display name.

For persistence, Defendnot creates an autorun through the Windows Task Scheduler so that it starts when you log in to Windows.

While Defendnot is considered a research project, the tool demonstrates how trusted system features can be manipulated to turn off security features.
Microsoft Defender is currently detecting and quarantining Defendnot as a 'Win32/Sabsik.FL.!ml; detection.

New 'Defendnot' tool tricks Windows into disabling Microsoft Defender

A new tool called 'Defendnot' can disable Microsoft Defender on Windows devices by registering a fake antivirus product, even when no real AV is installed.

www.bleepingcomputer.com

 

[Bot]

This is indeed concerning news. It's important to remember that while Defendnot is currently a research project, it does highlight potential vulnerabilities in Microsoft Defender. Users should ensure their systems are updated and monitored to prevent such exploits. Microsoft is currently detecting and quarantining Defendnot, which is a positive step.

 

[Andy Ful]

For the record. Any AV/EDR can be disabled when the attacker is allowed to use high privileges.

 

[Parkinsond]

For the record. Any AV/EDR can be disabled when the attacker is allowed to use high privileges.

But some AVs need more effort to bypass than others.

 

[Parkinsond]

For the record. Any AV/EDR can be disabled when the attacker is allowed to use high privileges.

I did not observe; apologies for redundancy.

 

[Andy Ful]

But some AVs need more effort to bypass than others.

There are at least three general methods to tamper with most AVs (similar effort required).

Edit.
The method from the OP is interesting and specific to the default AV in Windows. However, the method is rather complex, and we do not know (so far) how efficient it can be in the wild.

 

[Andy Ful]

Microsoft applied a controversial method of changing the Defender settings via PowerShell, GPO, or reg tweaks (convenient for Administrators).
So, it is easier for attackers to tamper with some settings (like folder exclusions), but it is also easier for Administrators to recognize the attacks.

For home users, it would be safer if more settings were protected by Tamper Protection. The problem can be partially solved by using a Standard User Account.

 

[Parkinsond]

Microsoft applied a controversial method of changing the Defender settings via PowerShell, GPO, or reg tweaks (convenient for Administrators).
So, it is easier for attackers to tamper with some settings (like folder exclusions), but it is also easier for Administrators to recognize the attacks.

For home users, it would be safer if more settings were protected by Tamper Protection. The problem can be partially solved by using a Standard User Account.

Whichever security software you are using, when you are personally targeted, nothing will help.
They only work for occasional malicious websites, email links/attachments, or sketchy software downloads.
As @bazang always say, security is a process; user behavior comes first.

 

[Andy Ful]

Whichever security software you are using, when you are personally targeted, nothing will help.

Yes, if one is a target of a highly motivated attacker, nothing will help.
Anyway, both user behaviors and security software can highly decrease the chances of being a target.

They only work for occasional malicious websites, email links/attachments, or sketchy software downloads.

It is true for good standard security software at home.
However, there are many other security-oriented software that can prevent/mitigate more advanced attacks. The attacker may lose interest and look for an easier target.

As @bazang always say, security is a process; user behavior comes first.

User behavior is usually the most important factor that affects the user's security. So, users who can learn can get the most advantage from improving their behaviors (like many MT members).
However, average users often do not want to learn or simply do not have time for learning security matters. For those users, security software can be more important. It can also be important for people who start learning about security.

 

[bazang]

Yes, if one is a target of a highly motivated attacker, nothing will help.

A well-funded, persistent threat actor is, indeed, a formidable adversary - and they don't even need to be highly skilled nation-state threat actors.

Anyway, both user behaviors and security software can highly decrease the chances of being a target.

Habitual, disciplined good cyber hygiene practices are a form of insurance policy.

The reasons for inadequate and insufficient cybersecurity practices is highly complex. There are societal, economic, social, and behavioral causes. I will call-out lax corporate cybersecurity practices as one of the largest contributors to data insecurity.