In our latest episode of the ConversingLabs podcast, host Paul Roberts interviews ReversingLabs researcher Joseph Edwards about his analysis of Follina, a newly discovered exploit with a pretty name, but nasty intentions.
As Edwards explains in the interview, Follina — which takes its name from the town in Northern Italy (more on that in the podcast) — is evidence of the continued innovation of malicious actors as they look for ways around security measures designed to thwart common attacks and exploits, such as Microsoft’s decisions to disable the use of macros by default in Microsoft Office documents.
In the case of Follina, Edwards found that the exploit leveraged a flaw in a standard Windows component, the Microsoft Support Diagnostic Tool, or MSDT, a program that streamlines troubleshooting for files on Windows. The vulnerability in MSDT allows attackers to trick the troubleshooting protocols and execute code, using a program of their choice.
“From the attacker’s standpoint, you’re leveraging something that is a standard component of all Windows systems and that doesn’t require attackers to authenticate first.”
[ Explore the Follina exploit in our new ConversingLabs episode ]
*** This is a Security Bloggers Network syndicated blog from ReversingLabs Blog authored by Paul Roberts. Read the original post at: https://blog.reversinglabs.com/blog/conversinglabs-unpacking-the-follina-exploit
Original Source link