Windows Smart App Control and SmartScreen possess inherent vulnerabilities that enable attackers to circumvent security measures, including LNK file manipulation, which allow malicious actors to establish initial access without triggering warnings or pop-ups.
Microsoft integrated SmartScreen into Windows 8 to protect users from potentially harmful files marked with the Web of Trust. Windows 11 introduced Smart App Control, an enhanced version that proactively blocks untrusted applications by querying a cloud service.
While SmartScreen operates on files with the Mark of the Web, SAC offers broader protection by blocking specific file types if marked. Leveraging undocumented APIs, researchers developed a tool to assess file trust levels for both systems, aiding in security analysis.
Attackers increasingly sign malware with code-signing certificates to bypass security controls like Smart App Control. Despite stringent issuance requirements, threat actors have obtained Extend Validation certificates through fraudulent means, enabling them to impersonate legitimate entities.
Certificate authorities (CAs) are failing to adequately address this issue, allowing attackers to leverage multiple certificates for malicious campaigns. Increased public scrutiny and research are needed to compel CAs to strengthen verification processes and reduce the availability of fraudulently-acquired certificates.
Reputation hijacking exploits trusted applications to bypass security systems. Attackers identify applications with good reputations, like script hosts with foreign function interfaces, and repurpose them to execute malicious code.
A successful hijack of the JamPlus build utility to get around Smart App Control without setting off alerts demonstrates how attackers can get around security measures and gain unauthorized access to systems by using these trusted applications.
Attackers can bypass security mechanisms like SmartScreen by exploiting vulnerabilities in known applications. Simple methods include buffer overflows, while more complex attacks chain multiple applications to achieve arbitrary code execution.
For instance, an application reading a configuration file and executing a command can be used to launch another app with specific parameters, ultimately granting full control over the system.
Reputation seeding involves introducing malicious binaries disguised as benign applications to a system, which can acquire a good reputation over time, allowing attackers to later exploit them.
Smart App Control is vulnerable to this, granting good labels to seemingly benign binaries after only two hours. Basic anti-emulation techniques can influence this reputation positively.
By manipulating code segments without affecting the fuzzy hash or feature-based similarity scores, they managed to create a malicious binary with a unique hash that maintained a benign reputation, allowing it to bypass SAC’s enforcement mode and execute malicious code, specifically a “calc” shellcode.
According to Elastic Security Labs, LNK Stomping is a technique that exploits a vulnerability in Windows Explorer to bypass security measures like SmartScreen and Smart App Control.
Malicious actors craft LNK files with non-standard target paths, tricking Explorer into modifying and saving the file in a canonical format, thereby removing the Mark of the Web label.
%20(1).webp?w=1200&resize=1200,0&ssl=1 "Nigerian Hackers Sentenced for Business Email Compromise Targeting Education Institutions")
