Windows EFS Feature May Help Ransomware Attackers
- Thread starter LASER_oneXM
- Start date
Related:
safebreach.com
Demonstration of the importance of my first line of defense:
The browser.
Even this new future threat cannot act in my OS W.XP.
Cyber Security News | EFS Ransomware
In this article, learn about EFS-based ransomware (ransomware which abuses the Windows Encrypting File System).
safebreach.com
Demonstration of the importance of my first line of defense:
The browser.
Even this new future threat cannot act in my OS W.XP.
EFS is present from Windows 2000 and beyond, including XP. I know Microsoft will patch it in 8.1 and 10, but not on older OSs. Also, I use Avast (which doesn't support XP anymore) which already has patched it.
You will notice that I wrote my OS W.XP.
_________________________________________
NTFS - Wikipedia
P.S.
This is not my area of expertise.
Encrypting File System - Wikipedia
So probably EFS on FAT32 doesn't work.
My FS is in FAT32 to be less compatible for new threats.
I would be very interested if some member of MT who is competent in this sector can have his say, even if I refute my hypothesis we would miss him.
Last edited:
Yeah, thanks for pointing out.
Most of the home users on Home and Pro editions are unaffected. I just checked and the registry key is unavailable for me on Windows 10 Pro.
It is also present in my W.10 Home but the service is stopped:
Guys I disabled it.
Start the service is also possible from SUA.
Remember if you can do it from SUA, malware can do it too.
So I disabled it.
Curious, when I started the service I couldn't stop it.
I had to use the administrator prompt:
sc config EFS start= demand
reboot pc
Both Microsoft and Avira won't bother to implement a fix, yet Iobit which is considered a below average security product will.
F
ForgottenSeer 823865
What you mean by you can start it from SUA, You can access services panel from SUA and change the services?Guys I disabled it.
Start the service is also possible from SUA.
Remember if you can do it from SUA, malware can do it too.
So I disabled it.
Last edited by a moderator:
F
ForgottenSeer 823865
Maybe with UAC at default, but if set at max or in my case, with a setting that prevent execution of admin tools in SUA, it won't be possible.
My UAC is always on.
But frankly I don't remember, now, if I opened the prompt window to access the services, as administrator.
And now that I have disabled it, I don't want to repeat the whole procedure.
You have to try it, Umbra.
Also because I was surprised that once the service started it could not be stopped.
I insert 2 images below from SUA and Administrator:
SUA
Administrator:
As you can see a potential malware at least initially can only modify, as an administrator, the service.
Don't start it.
Last edited:
F
ForgottenSeer 823865
i think you did.My UAC is always on.
But frankly I don't remember, now, if I opened the prompt window to access the services, as administrator.
no thanks, im lazy as well to disable all my security settings just to cross-check LOLAnd now that I have disabled it, I don't want to repeat the whole procedure.
You have to try it, Umbra.
indeed, surprisingAlso because I was surprised that once the service started it could not be stopped.
Yes i was intrigued how you could manipulate a service from SUA, shouldn't be possible.
Any W.XP OS with FS FAT32 is immune to the problem.
So my choice after 2014 to have an unusual FS is paying off.
So my choice after 2014 to have an unusual FS is paying off.
F
ForgottenSeer 823865
I will say all those PoC are made with the OS at default, if hardened or protected by some softs, many of them will be countered whatever the OS.
For example, if you didn't hardened or tweaked your XP, it would be extremely risky to use it in our time.
XP was made in an era where the most virulent malware were just backdoors (Subseven, etc...).
Umbra I did a try again.
I opened the fax service from SUA.
This service is in the same conditions as EFS.
As you see "manual" "stopped" but with the "start" button available:
And I'm ready to bet that from SUA I can start the fax service without UAC.
Follow my advice, turn off the EFS service.
P.S.
I'm sure then I couldn't stop the service because I was in SUA.
But being able to start it is very worrying.
Last edited:
W.10 Home 1909.
Confirmed.
Some services can be started without UAC (always on) from SUA:
P.S. in the specific case in my pc the fax service is not activated due to lack of use services.
Confirmed.
Some services can be started without UAC (always on) from SUA:
P.S. in the specific case in my pc the fax service is not activated due to lack of use services.
On the off chance anyone wanted to retain EFS usage for Administrators but prevent Standard Users from making use of the service you could also adjust the SDDL to remove user access to the EFS service.
I made a simple .inf for the EFS service via mmc and applied it using LGPO. After a reboot I could use encryption from an Administrator account but Standard Users would get an access denied even if the service was already running.
It basically just removed some potentially problematic rights for App Packages (AppX), Authenticated Users & Interactive Users leaving just Administrators, Service and System rights intact. You could also do the same from a System integrity CMD prompt via nsudo (or similar) using SC just don't forget to reboot.
I made a simple .inf for the EFS service via mmc and applied it using LGPO. After a reboot I could use encryption from an Administrator account but Standard Users would get an access denied even if the service was already running.
Code:
[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Service General Setting]
"EFS",3,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPLOCRRC;;;BA)(A;;CCLCSWRPLOCRRC;;;SU)S:(AU;SAFA;DCSDWDWO;;;WD)"It basically just removed some potentially problematic rights for App Packages (AppX), Authenticated Users & Interactive Users leaving just Administrators, Service and System rights intact. You could also do the same from a System integrity CMD prompt via nsudo (or similar) using SC just don't forget to reboot.
Code:
SC SDSET EFS D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPLOCRRC;;;BA)(A;;CCLCSWRPLOCRRC;;;SU)S:(AU;SAFA;DCSDWDWO;;;WD)You may also like...
-
Ransomware Protection - Do You Actually Trust "Rollback" Features in Paid AVs?- Started by Bot
- Replies: 28
-
Kaspersky and various other AVs can't detect simple ransomware script
- Started by Ahmed Uchiha
- Replies: 84
-
New HybridPetya ransomware can bypass UEFI Secure Boot- Started by Parkinsond
- Replies: 3
-
New ShrinkLocker ransomware decryptor recovers BitLocker password- Started by Gandalf_The_Grey
- Replies: 0
