????? ??????? ??? ??? ? ?????????? ?????? ????? ?? ??????????????? ?????? ?? ????? ???? ??? ?? ??????? ?? ????[?] ?? ?? ?? ????????????? ????? ?????? ???? ????? ???? ?? ??? ?? ????? ?????? ???? ?? ????? ????????? ?? ??? ??????? ???? ??????????? ???? ????? ???.
??? ??? ?? ?? ??? ????? ??? ?? ????????? ?????? ? ?? ??? ?? ????????? ??? ???? ?????. ???? ??????? ?? ?? ???? ?? ??? ?????? ??? ????? ?? ?? ??? ??? ??? ? ?? ????? ?? ?? ?????????? ?? ??? ?????? ??? ?????? ?????. ??? ?????????????? ?????? ?? ????? ??? ?? ?????????? ?? ?????? Edge ????? ?? ?? ??? ????? ????? ???????.
?? ??? ?????? ?? ??? CVE-2023-28252 ?? ??? ??????????? ???? ???? ????? (?????? ?/? ?? ????? CVSS)? ?? ??? ?????? ??? ?????? ?? Windows Common Log File System (CLFS) Driver ???.
?????????? ?? ?????? ???: ?????? ?? ?? ?????? ?? ??? ?????????? ??????????? ???? ???????? ???????? ????? ?? ?? ??? ????.
CVE-2023-28252 ??????? ??? ?????? ??? ?????? ?? ????? CLFS ??? ?? ???? ?? ??? ????? ?? ?? CVE-2022-24521? CVE-2022-37969? ? CVE-2023-23376 (????? ? ?? ????? CVSS) ???? ??????????? ???? ???? ????? ???. ????? ?? ?????????? ?? CLFS ?? ??? ???? ??????? ??? ???.
?? ???? ???? ????? ?????? ???? Kaspersky? ??? ?????????? ???? ?? ???? ????? ?????? ???? ??????? ????????? Nokoyawa ???? ????? ???? ? ????? ?? ?????????? ??????? ????? ? ???? ??????????? ???? ????? ???[?].
Larin ?????????? ???[?]: «CVE-2023-28252 ?? ?????????? ????? (??????) ???? ?? ?????? ??? ?? ???????? ????? ?? ????? ???? ?????? metadata block ?? ????? ???? ???? ??????????? ???? ????. ??? ?????????? ?? ???????? ???? ??? ???? ????? ??????.»
?? ???? ?? ??????????? ????? ?? ??? ???? CISA ??? ??? ??? ?????? ?? ?? ??????? ?????????????? ???? ??????????? ?????????? ([?]KEV) ????? ???? ???[?] ? ?? ????????? ???? ?????? ???????? ????? (FCEB) ????? ?????? ?? ????????? ??? ?? ?? ? ?? ???? ???? ????.
?????? ??????? ????? ?? ?? ??? ??? ????? ?? ?? ????? ???? DHCP? ?????? ???? ??? ???? ?? ????? Raw Image? ?????? ???? Point-to-Point ??????? Pragmatic General Multicast ??????? ? Microsoft Message Queuing ?? MSMQ[6] ????? ?????????? ???? ???????.
??? MSMQ ?? ???????? CVE-2023-21554 (????? ?????? ?/? ?? ????? CVSS) ?????? ?????? ?? ???? Check Point ?? ????? QueueJumper ?????? ??????? ???????? ???? ?? ????? ?? ??????? ??? ? ?? ????? ?? ???? ???? MSMQ ????????? ??? ?? ???? MSMQ? ???? ?? ??? ????? ??? ??????.
Haifei Li ???? Check Point ?????????? ???[?]: «?????????? CVE-2023-21554 ?? ????? ????? ?????? ?? ?????? ?????? ?? ?? ??? ??? ? ???? ???? ?? ?? ????? ?? ???? TCP 1801 ???? ???. ?????????????? ?? ????? ???????? ????? ?????? ?? ???? ?? ???? ?? ???? ?? ???? ????/tcp ?? ??????????? ?? ??? ???? ? ?????????? ?? ????? ???.»
?? ??? ???? ??????? ?? MSMQ? CVE-2023-21769 ? CVE-2023-28302 (???????? ?/? ?? ????? CVSS)? ????????? ???? ????? ????? ????? ????? (DoS) ????? ????? ????? ?Windows Blue Screen of Death ?? BSoD ???? ??????????? ???? ?????[?].
?????????? ?????? ????? ??? ?? ???? CVE-2013-3900? ??????????? ?????? ?? ???? ????? WinVerifyTrust? ?????? ???? ??? ?? ???? ???????? ??? ???? ???? ??? ????:
- Windows Server 2008 for 32-bit Systems Service Pack 2
- Windows Server 2008 for x65-based Systems Service Pack 2
- Windows Server 2008 R2 for x64-based Systems Service 1
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
??? ????? ????? ???? ??????? ?? ????? ????? ????? ?? ??? ????? ?? ??? ??? ??????? ???????[?] ?? ?? ????? ???????????? ?? ?? ???????????? ?????? ???? ???? ???? ????? ??????? ???? ?????????? ???? ????.
??????? ?????????? ???? ????? BlackLotus Bootkit
??????? ?? ??? ???????????? ??? ??? ?????? ?????? ??????????????? ?? ???? CVE-2022-21894 (????? ?? Baton Drop)? ?? ??? ??? ??? Secure Boot ?? ????? ????? ??? ??? ?? ???? ????? ????? ?? ??????? ?? ??? ??? ???? Unified Extensible Firmware Interface (UEFI) ?? ??? BlackLotus[10] ???? ????? ??????? ?? ?????? ???? ??????????? ???? ????? ???.
???? ?? ???????? ???? (IoC) ???? ???????? ???????? ?????? ???????? ? ??????? ?? ??????? ????? EFI ([11]ESP)? ????????? ?????? ????? ?? ???? ?????????? Microsoft Defender? ???? ????????? ?????????? ESP:/system32/? ? ??????? ?? ?? ???? ???????[??] ?? ???? ??? ???:
HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity.
??? ?????????? Incident Response ?????????? ???????[??]: «??????????? UEFI ??????? ?????? ?????? ???? ?? ????? ?????????? ??????? ??? ?? ??????? ?????????? ???? ???????? ? ???????? ????????? ?? ??????????? ?????? ????? ?????????? ????? ?? ????? ?? ??????? ????».
?????????? ?????? ????? ???? ??? ?? ????????? ?????????? ????????? ?? ?? ???? ??? ???? ? ????? ?? ???? ?????? ?? ?????????? ???? ????? ????? ????????? ?? ?? ?? ???? ??????? ???? ?????????? ?? ???? ??????? EFI ???? ?????? ????????? ?? ??????? ????? credential hygiene ?? ??? ????? ? ??? ????? ?????? ?? ???? ???? ([??]PoLP).
???????? ?????????? ?? ???? ?????????
????? ?? ??????????? ??????????????? ?????? ???? ???? ????????? ??? ?? ??? ???? ????? ???? ????? ????? ?????????? ????? ??? ???? ??????:
- Adobe
- AMD
- Android
- Apache Projects
- Apple
- Arm
- Aruba Networks
- Cisco
- Citrix
- CODESYS
- Dell
- Drupal
- F5drupal.org/security
- Fortinet
- GitLab
- Google Chrome
- HP
- IBM
- Jenkins
- Juniper Networks
- Lenovo
- Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
- MediaTek
- Mozilla Firefox, Firefox ESR, and Thunderbird
- NETGEAR
- NVIDIA
- Palo Alto Networks
- Qualcomm
- Samba
- Samsung
- SAP
- Schneider Electric
- Siemens
- SonicWall
- Sophos
?????
[?] https://msrc.microsoft.com/update-guide/releaseNote/2023-Apr
[?] https://thehackernews.com/2022/07/researchers-share-techniques-to-uncover.html
[?] https://securelist.com/nokoyawa-ransomware-attacks-with-windows-zero-day/109483
[?] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[?] https://www.cisa.gov/news-events/alerts/2023/04/11/cisa-adds-one-known-exploited-vulnerability-catalog
[?] https://learn.microsoft.com/en-us/previous-versions/windows/desktop/msmq/ms703216(v=vs.85)
[?] https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service
[?] https://en.wikipedia.org/wiki/Blue_screen_of_death
[?] https://thehackernews.com/2023/04/cryptocurrency-companies-targeted-in.html
[??] https://apa.aut.ac.ir/?p=9521
[??] https://en.wikipedia.org/wiki/EFI_system_partition
[??] https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement
[??] https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign
[??] https://en.wikipedia.org/wiki/Principle_of_least_privilege
[??] https://thehackernews.com/2023/04/urgent-microsoft-issues-patches-for-97.html
