A new research discovery, shows that hackers can leverage security weakness in windows container framework, enabling them to bypass end-point security solutions and infecting their target with malware.
A researcher from Deep Instinct Security by the name Daniel Avinoam, presented these findings in the DEFCON event which held in August 2023.
In an information posted on the defcon forum in June 14 2023, Daniel shared on how hackers can stay undetected using windows container isolation framework. He stated:
“The use of containers became an integral part of any resource-efficient and secure environment. Starting from Windows Server 2016, Microsoft released its version of this solution called windows containers, which offers either a process or Hyper-V isolation modes. In this presentation, we will cover the basics of windows containers, break-down its file system isolation framework, reverse engineer its main mini-filter driver, and see how it can be utilized and manipulated by an actor to bypass EDR products in multiple domains.”
The Microsoft’s container architecture and support for Windows Sandboxing, utilizes what is known as dynamically generated image making it easy, to segment various file systems from each of the containers to the host, and at the same time prevent the duplication of system files.
In a blog research post conducted by deep instinct, the discovery shows the two isolation modes the windows container run on; The process isolation Mode, and the Hyper-V Isolation Mode.
Further code analysis by Daniel, shows how the Silos, can be considered as an extension of jobs, used for process grouping and provide additional features. This is detected by the window kernel processes, which is assigned to use Silos via API’s.
In a report shared with TheHackerNews Daniel stated:
“It was at this point that the idea struck me. What if we can use this redirection mechanism to obfuscate our file system operation and confuse security products?”
This describes the importance of the Windows Container Isolation File System (wcifs.sys) driver. Its major function, is to ensure the separation of file system between the host and windows container.
It is further described that in other for a threat actor to pull of such attack, they sure have to be a system administrator or have administrative permissions, to communicate with the wcifs driver, and it cannot be used to override files on the host system.
For further details about the research, read here.
Microsoft also issued a public statement after the researchers have informed the organization about their findings; the OS company said:
“This has been determined to be a malware detection evasion technique and not security vulnerability that would be serviced in a security update.”
Please do let us know in the comment section what are your thoughts about this.