Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 712397">Any process trusted by Pumpernickel, as long as you can inject code into that trusted process, then you can evade the whole file-system operations restrictions. Pumpernickel driver uses FltRegisterFilter kernel-mode callback but it will allow programs granted access on the list, so target one of those and you&#039;re in.It can become a bit complicated if the trusted processes are only elevated ones though and the attacker only has standard rights, but explorer.exe is not elevated and Pumpernickel will allow explorer.exe (by default at least? AFAIK) because otherwise the user cannot browse the files themselves. Which makes explorer.exe a good vulnerable target for standard rights malware.However a lot of malware in the wild targeting home users is simply crap and not very sophisticated. You have exceptions every now and then (usually with a break-out which has good spreading capabilities) but the chances of malware adapting to bypass Pumpernickel any-time soon is small.Attackers know they can do bare minimal or just use a crappy ransomware sample from a Ransomware-As-A-Service from the dark web to generate income, because it&#039;ll do the job. They don&#039;t necessarily care about going to great lengths anymore.6 years ago you&#039;d be finding time-consumed for development rootkits using some undocumented technique to get the unsigned driver loaded, now you just find 20 minute ransomware built in C# using copy-pasted code or some PowerShell script.</blockquote>

[QUOTE="Deleted member 65228, post: 712397"] Any process trusted by Pumpernickel, as long as you can inject code into that trusted process, then you can evade the whole file-system operations restrictions. Pumpernickel driver uses FltRegisterFilter kernel-mode callback but it will allow programs granted access on the list, so target one of those and you're in. It can become a bit complicated if the trusted processes are only elevated ones though and the attacker only has standard rights, but explorer.exe is not elevated and Pumpernickel will allow explorer.exe (by default at least? AFAIK) because otherwise the user cannot browse the files themselves. Which makes explorer.exe a good vulnerable target for standard rights malware. However a lot of malware in the wild targeting home users is simply crap and not very sophisticated. You have exceptions every now and then (usually with a break-out which has good spreading capabilities) but the chances of malware adapting to bypass Pumpernickel any-time soon is small. Attackers know they can do bare minimal or just use a crappy ransomware sample from a Ransomware-As-A-Service from the dark web to generate income, because it'll do the job. They don't necessarily care about going to great lengths anymore. 6 years ago you'd be finding time-consumed for development rootkits using some undocumented technique to get the unsigned driver loaded, now you just find 20 minute ransomware built in C# using copy-pasted code or some PowerShell script. [/QUOTE]

Verification