Varonis discovers Windows event log exploits
Data security and analytics company Varonis has discovered two new vulnerabilities in the Windows event log left behind from the legacy of the now-discontinued Internet Explorer.
The company has provided details of two proof-of-concept exploits including LogCrusher, which allows any domain user to remotely crash the Event Log application of any Windows machine on the domain.
Meanwhile, the OverLog exploit can be used to cause a remote denial-of-service attack by filling the hard drive space of any Windows machine on the domain, Varonis said.
While Microsoft has issued a partial patch for the exploits, LogCrusher can still be performed by attackers that gain access to a victim’s network.
Without logs, security controls are blind, and some security control products even attach themselves to the logger service, meaning taking down the service can disable the controls, Varonis warned. This could allow an attacker to use any type of usually detected exploit or attack with impunity.
Meanwhile, there remains potential for other user-accessible application Event Logs to be similarly leveraged for attacks, the company added.
Threat actors using aggressive new extortion tactics: report
The latest extortion and ransomware report from Palo Alto Networks reveals aggressive new tactics...
Tenable adds third-party connectors to Tenable One
Tenable has introduced a range of third-party data connectors to its Tenable One...
Arctic Wolf launches incident response platform
Arctic Wolf has launched a new solution combining incident readiness with incident response...
