KHOBE could infect any Windows XP system

Researchers at Matousec have found malware that could potentially compromise nearly every Windows XP system using current antivirus software. KHOBE (Kernel Hook Bypassing Engine) takes advantage of the vulnerable System Service Descriptor Table to trick Microsoft's OS into accepting rogue code. It allows a safe code thread to be scanned by antivirus apps but immediately swaps in a thread containing a virus or other attack, giving the malware free rein.

Few antivirus programs today can protect against an attempt since they can't stop the switch after they've already examined what was believed to be the original code. Tools can screen for the content before it reaches the system and can block known malware, but any unknown viruses will automatically get access. Administrator rights also aren't necessary and could expose even limited Windows accounts to the threat.

The attacks won't work properly on Windows Vista or 7 systems, but as these are still in the minority, most computers worldwide are susceptible to a KHOBE virus. Modern, multi-core processors are actually more vulnerable since the hostile thread can be more readily kept separate from any inspection by antivirus tools.

Software developers like F-Secure and Sophos have pledged themselves to identifying the attacks and minimizing the risk, but the new vulnerability is currently a blow to the Windows environment, especially in developing countries where Windows 7 is still rare or unfeasible for the systems users can afford. Linux and Mac OS X systems aren't known to be vulnerable to this kind of attempt. [via ZDNet]

By Electronista Staff

Post tools:

TAGS :  

industry, security, software, Microsoft, F-Secure, Sophos, Matousec