Researchers from enSilo may have too much time on their hands: Instead of putting out fires, they came up with a method to nuke Windows security. To make it worse, this attack vector cannot be patched because of how it uses Windows atom tables, which are basic system calls, to operate.

Windows Atom Tables

Softpedia noted that Windows features a data structure called an atom table. It’s a system-defined table that stores strings and corresponding identifiers.

Applications place a string inside an atom table and receive a 16-bit integer, called an atom, in return. This atom can then access the string. Because they are shared tables, different apps can access and alter data inside them.

Code injection is a popular cybercriminal tool, and fraudsters often use it to place malicious code into legitimate processes. This makes it easier for an attacker to bypass security products, hide from the user and extract information that would otherwise be unattainable.

enSilo found that an attacker could write malicious code into an atom table, which would “force a legitimate program to retrieve the malicious code from the table.” The researchers also found that cybercriminals could alter the infected program to execute that malicious code.

An Atomic Cocktail

This novel injection method bypasses the signature-based recognition of most endpoint security products. Additionally, those tools usually include a white list of trusted processes — which often include atom tables. Should an attacker inject malware code into one of those trusted processes, the security product in question could be fooled.

Such an attack vector would be very useful in a man-in-the-browser (MitB) attack, which is often seen in banking Trojans. Malware using this vector may also take screen shots of the user’s screen or access encrypted passwords. In fact, it could perform any other action that a white listed application could.

AtomBombing

AtomBombing, as enSilo called it, will affect all Windows versions. There is no patch to remediate this kind of attack, since the underlying problem is a design flaw, not a vulnerability.

The only hope enSilo sees requires a different take on how the security product works. “The direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity,” the report explained. An alternative solution would be to replace Windows with a more secure operating system.