Windows Bind Link Attacks: A New Evasion Technique
Security researchers at Bitdefender have demonstrated three attack techniques in which Windows’ bind links can be used to evade endpoint detection and response (EDR) products. Bind links are a legitimate Windows feature implemented by bindflt.sys and used by Store apps, Windows Sandbox, and Windows containers.
How Bind Links Work
Bind links are a kernel-level redirection mechanism that creates a virtual path that transparently maps onto the real backing path. However, if the bind link is altered so the backing path points to a file controlled by an attacker, then that file is accessed effectively invisibly.
Under certain circumstances, this could lead to loading hidden malware while all the system sees is a visible link pointing at a known innocuous file. For example, if the backing path is pointed at a DLL, it becomes file-binding: a process loads an attacker’s file from a path it trusts.
Attack Techniques
Bitdefender researchers describe three attack techniques that manipulate bind links. The first is ‘file-binding’, or simple path hijacking. Using this technique, the researchers provide an example of defense evasion – specifically evading AMSI.dll (the Antimalware Scan Interface).
PowerShell is one of the Windows apps that invokes AMSI to check its script (others include Windows Script Host, the JavaScript and VBScript engines, and Office macro execution paths). PowerShell normally starts and loads amsi.dll to scan script content before execution. But if an attacker has prepared the battlefield, a bind link will hijack the link and redirect it to the attacker’s fake dll.
This is invisible to normal user-mode and most EDR file-system monitors. Scanners usually see the virtual path as if it were the real one, while receiving data from the false backing path without knowing it.
Process-Binding and Silo-Binding
The second attack technique is termed ‘process-binding’. It is file-binding applied to executable images (and could be used to by-pass EDR detection). If the process trusts the file path as the target, a bind link can redirect it to a meaningless file.
Winver.exe would be a good example and is often used in other disguised attacks. When the EDR is loaded, it checks the file path and assumes it to be correct. So, it ‘believes’ it is examining what it should examine but actually looks at the harmless winver.exe.
The file containing the attacker’s instructions becomes invisible to the EDR and the user. The third attack technique is silo-binding, which requires a user-defined Windows silo. A silo gives the processes it contains an isolated view of the system: its own file paths, registry, and object names, walled off from everything outside.
A bind link within the silo is not a global link and cannot be detected outside of the silo. The result is that a path can resolve to one file within the silo, but a different file everywhere else. Inside the silo, the attackers can point to their own malware. But that malware can be detected by scanners operating from outside the silo.
Microsoft's Response
Microsoft assessed Bitdefender’s findings as low severity since it requires admin access. Bitdefender’s response is that criminals regularly obtain administrator access.
Bitdefender disclosed its findings, but Microsoft classifies the threat as low severity because it requires local administrator privileges. Bitdefender’s response is to point to the BYOVD (bring your own vulnerable device) attack method.
This also requires administrator access, but has become a common, industrialized, and ‘standard’ component of modern ransomware attack playbooks. Requiring admin access is not ‘game over’, says Bitdefender.
Source: SecurityWeek