Malicious actors have recently discovered a technique that exploits the Windows Container Isolation Framework, as revealed by security researcher Daniel Avinoam. This technique allows attackers to obfuscate their file system operations and confuse security products [2].
Description
The Windows Container Isolation Framework [1] [2] [3] [4], used by Microsoft’s container architecture [1] [3], generates images to separate the file system of each container from the host [1] [2] [4]. This reduces the overall size of the operating system [2]. The Windows Container Isolation FS driver is responsible for this file system separation [1]. Attackers exploit this driver to run their processes inside a fabricated container, enabling them to perform file operations without triggering security software [2] [4]. They override files using the IOREPARSETAGWCI1 analysis tag [1], bypassing antivirus detection [1]. This evasion technique requires administrative permissions and cannot override files on the host system [2] [4]. The wcifs driver has a lower altitude range than antivirus filters [4], allowing it to override files without detection [4]. This discovery coincides with the demonstration of another technique called NoFilter [2], which abuses the Windows Filtering Platform to elevate user privileges and potentially execute malicious code [2] [4].
Conclusion
This technique poses a significant threat as it allows attackers to evade antivirus detection and potentially execute malicious code. Mitigations should focus on strengthening administrative permissions and enhancing antivirus filters to detect and prevent these attacks. The discovery of this technique also highlights the need for continuous monitoring and research to stay ahead of evolving threats in container architectures.
References
[1] https://teknomers.com/es/los-piratas-informaticos-pueden-aprovechar-el-marco-de-aislamiento-de-contenedores-de-windows-para-eludir-la-seguridad-de-los-terminales/
[2] https://thehackernews.com/2023/08/hackers-can-exploit-windows-container.html
[3] https://cybersec84.wordpress.com/2023/08/30/hackers-use-windows-container-isolation-to-bypass-endpoint-security/
[4] https://vulners.com/thn/THN:65A9C0A3C67785300C70F48203512803
