RedSun: Chaotic Eclipse releases the next zero-day exploit

A security researcher who works under the pseudonym “Chaotic Eclipse” has made another previously unknown vulnerability in Windows public within two weeks. This is located in the antivirus program Microsoft Defender.

Defender becomes a point of attack

The now presented proof-of-concept exploit with the title “RedSun” allows attackers to gain extensive system privileges under current versions of Windows. This works even on systems that are currently fully patched, so you are dealing with a classic zero-day vulnerability. Specifically, the problem is a local privilege escalation (LPE).

Windows 10, Windows 11 and Windows Server versions are affected if Microsoft Defender is activated. According to the description, the exploit uses unusual behavior of the virus scanner off: If Defender detects a potentially malicious file with a so-called cloud tag, the program writes this file back to its original location. This behavior can be manipulated to overwrite system files and ultimately gain administrative SYSTEM rights.

Security analyst Will Dormann confirmed the exploit’s functionality to US magazine BleepingComputer. Accordingly, the attack uses, among other things, the Cloud Files API, a test file for antivirus programs (EICAR) and technical tricks such as so-called oplocks and directory redirections. This ensures that a manipulated file is written to a sensitive system directory and then executed with the highest rights.

AV solutions sometimes fail

Some antivirus solutions detect the exploit because the EICAR test signature is included. However, detection could be significantly reduced using simple obfuscation techniques. More technical details another security researcher published under the name Kevlar. Last week, “Chaotic Eclipse” had already published a similar vulnerability with “BlueHammer”, which has since been closed by Microsoft.

The researcher sees both publications as a protest against the company’s handling of external security reports. He makes serious allegations and describes the cooperation with the Microsoft Security Response Center as extremely negative. Microsoft rejected the criticism and emphasized that it carefully investigates reported security problems and relies on coordinated disclosure to best protect users.