Two security researchers from enSilo have discovered a new code injection technique called Process Doppelganging. The new attack method works on most versions of Windows and bypasses almost all security products.
The technique it uses is very similar to that of “Process Hollowing” used by Scarab Ransomware, however, it has some details that differentiate it. Doppelganging works by exploiting the NTFS Transaction function. It has the ability to make changes to executable files without them being recorded on disk. It creates a fake entry in memory and the files are loaded normally by Windows. Any malicious code continues to run without any problems. The researchers simultaneously tested various security programs during the whole process, but the results were discouraging. Specifically, they tried the following:
- Windows Defender Windows 10 (ByPass)
- AVG Internet Security Windows 10 (ByPass)
- Bitdefender Windows 10 (ByPass)
- ESET NOD 32 Windows 10 (ByPass)
- Qihoo 360 Windows 10 (ByPass)
- Symantec Endpoint Protection Windows 7 SP1 (ByPass)
- McAfee VSSE 8.8 Patch 6 Windows 7 SP1 (ByPass)
- Kaspersky Endpoint Security 10 Windows 7 SP1 (ByPass)
- Kaspersky Antivirus 18 Windows 7 SP1 (ByPass)
- Symantec Endpoint Protection 14 Windows 7 SP1 (ByPass)
- Panda Windows 8.1 (ByPass)
- Avast Windows 8.1 (ByPass)
As it appears, the Process Doppelgänging technique has managed to fool specific security software, which is troubling companies and users alike.
The good news is that the researchers did not reveal in detail the steps they took to exploit the security gap, but they emphasized that the process requires high knowledge and contains many technical difficulties.
The bad news is that there doesn't seem to be any easy solution to fix this flaw as it exploits some basic features of the Windows.
