5 October 2017

During a cycling trip through the Eifel national park last week, a new weakness called Illusion Gap was extensively discussed in the media.

Security researchers at CyberArk detected a feature in the Windows SMB Server that allows attackers to bypass Windows Defender, and possibly other anti-malware products, when serving an executable from a file share. For more details please see Kasif Dekel’s excellent post at the CyberArk Threat Research blog.

CyberArk notified Microsoft of this vulnerability, but Microsoft did not view it as a security issue:

“Thanks for your email. Based on your report, successful attack requires a user to run/trust content from an untrusted SMB share backed by a custom server that can change its behavior depending on the access pattern. This doesn’t seem to be a security issue but a feature request which I have forwarded to the engineering group.”

In my opinion, the effort to successfully exploit Illusion Gap appears to be somewhat too high:

First of all, an attacker must convince a user to execute a program that installs a specially crafted SMB server service on a Windows system. Since administrative privileges are required to do this the perfect victim should either work with permanent administrative rights or should at least have access to an administrative account he can leverage for UAC. Finally, the attacker must install a malicious and a clean version of the executable on the newly created file share and trick a user to run the executable from the share.

Since the attack complexity is high and authentication is required the likelihood of rapid detection is high. This is aggravated by the fact that the execution of programs from file shares is often used as indicator of compromise.

With this, we should not waste our time with Illusion Gap.

Have a great weekend.