Symantec encryption desktop shared machine drivers#
Symantec encryption desktop shared machine driver#
Symantec encryption desktop shared machine Patch#
Symantec encryption desktop shared machine full#

Symantec encryption desktop shared machine driver#

It was about time to bring in Windbg and start examining that kernel driver further.

Symantec encryption desktop shared machine full#

Our attempts to access that device object were blocked, even with full administrative privileges (High Integrity Level), but at the same time a process running with medium integrity had managed to obtain a handle with Read/Write access, and thus it was able to send I/O requests to the driver under examination. That process was running with Medium Integrity Level, though. In fact, there was a process called PGPtray.exe that had an open handle to the aforementioned device object. The results of that check were even more interesting. That was interesting enough by itself to make us start digging a bit deeper.īefore opening Windbg, we decided to perform a fast check over all running processes, in order to find out if at that point there was any process with an open handle to that device object. In other words, even an administrator was blocked from accessing that device object. However, by using WinObj from Sysinternals, even with full administrative privileges, we were immediately receiving an access denied error. To start with, by using DeviceTree by OSR, we could see that PGPwded.sys exposed a device object named PGPwdef.Īccording to its security attributes, all users should be able to access that object.

Symantec encryption desktop shared machine drivers#

While we were going through the exposed named device objects by the kernel drivers installed, we noticed something interesting.

Module: eedDiskEncryptionDriver.sys v11.1.3īefore discussing the two interesting input/output control requests (IOCTLs) and some associated code snippets, we need to focus on the practice that ultimately allows any user to take advantage of the disk read/write capabilities of the kernel driver under examination.

Symantec Endpoint Encryption version v11.1.3 MP1 and earlier.

Symantec Encryption Desktop suite version 10.4.1 MP2HF1 and earlier.

We will then discuss how access control to file and directory objects is enforced by NTFS, attack methods, problems, possible solutions to complete the exploit, and their limitations.īut first, here is a video demonstration of the vulnerability being exploited in the latest Windows 10 v1709 64-bit. We will provide a short overview of the discovery and nature of the vulnerability. Since many of the exploitation techniques that we come across rely on memory corruption, we thought that demonstrating exploitation of this type of flaw would be interesting and informative. They also allow the attacker to execute code in the context of the built-in SYSTEM user account, without requiring a reboot. These vulnerabilities allow an attacker to attain arbitrary hard disk read and write access at sector level, and subsequently infect the target and gain low level persistence (MBR/VBR). In this article we discuss various approaches to exploiting a vulnerability in a kernel driver, PGPwded.sys, which is part of Symantec Encryption Desktop. For more information, see the following SYMC Advisory:

Symantec encryption desktop shared machine Patch#

While there is no plan to produce a patch for Symantec Encryption Desktop, the Symantec Security and Development teams have recommendations to mitigate the risks involved. Symantec has produced a patch for Symantec Endpoint Encryption as of version 11.3.0 but not for Symantec Encryption Desktop. This vulnerability affected both Symantec Endpoint Encryption and Symantec Encryption Desktop. We will continue to work with Symantec to help them to produce an effective patch. Consequently, we are at the point of publishing the findings publicly. We have been working with Symantec to try and help them to fix this since our initial private disclosure in July 2017 (full timeline at the end of this article), however no patch has yet been released.

Note: These vulnerabilities remain unpatched at the point of publication.