ITSEC Newsletter 2024-01-04

Our investigation has revealed an innovative approach that leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL Search Order Hijacking technique. This method allows threat actors to circumvent high privilege requirements to execute malicious code in applications within the Windows folder, specifically WinSxS, and eliminates the need for additional binaries in the attack chain. Furthermore, it facilitates the execution of malicious code from any location, and it is compatible with both Windows 10 and 11.

Sometimes, making particular security design decisions can have unexpected consequences. For security-critical software, such as password managers, this can easily lead to catastrophic failure: In this blog post, we show how Bitwarden’s Windows Hello implementation allowed us to remotely steal all credentials from the vault without knowing the password or requiring biometric authentication. When we discovered this during a penetration test it was so unexpected for us that we agreed with our client to publish a blog post about it and tell the story.