Facepalm: Last year, Microsoft started digitally signing the log files of a Windows component that attackers had been abusing for years. The idea was that any tampered log would simply get rejected. But that same safeguard is now the way in for a new zero-day that lets a standard user take complete control of a PC. Ironically, the attack needs Microsoft's own antivirus running to pull it off.
This latest exploit is called SignDrop. It comes from Abdelhamid Naceri, a former Microsoft employee who has been dumping unpatched Windows bugs online under the name Nightmare Eclipse since April. He published the code on GitHub on Tuesday, just as Microsoft was rolling out its November security updates.
A bug like this is notable because it can turn a minor infection into a full takeover. Malware that slips in through a shady download usually runs with the same limited rights as the user. SignDrop would let it climb to the very top, where it can switch off security tools and dig in for good. And since the code is public, anyone can try it.
The bug sits in the Common Log File System (CLFS), which apps and drivers across Windows use to keep their logs. The problem is a small companion file it creates next to each log to help with recovery. That file inherits its permissions from the log, so whoever set up the log gets control of it.
That's where Defender comes in, since it runs with the highest privileges on the PC. SignDrop tricks the antivirus into opening a log the attacker prepared ahead of time. So the companion file gets created with Defender's top-level rights, yet the attacker still gets to control it.
From there, it's a short hop to a command prompt running as SYSTEM. That's the built-in account Windows reserves for its own core processes. It has more say over the PC than even an admin account.
Outside testing paints a much narrower picture. Vulnerability analyst Will Dormann told Ars Technica he managed to reproduce the exploit, but only on PCs running this year's Windows 11 26H2 update. Those machines also need to have been set up for more than 90 days, so a freshly installed copy won't work. Out of all the machines Dormann has on hand, exactly one qualifies.
For its part, Microsoft says it's investigating and hasn't seen the flaw exploited in the wild. The company also claims Defender already detects and blocks the attack.
Even so, Naceri's track record makes SignDrop hard to wave off. Three of his earlier Defender exploits, including BlueHammer, ended up in real attacks after he released them. As for a fix, one likely won't arrive before December's Patch Tuesday on the 8th unless Microsoft rushes it out.