During the recent DEF Con 33 conference, researchers Yair and Shahak Morag by Safebreach Labs presented A new and alarming class of attacks of denial of service (back), called Win-Dos Epidemic. This new research reveals four back vulnerabilities in Windows and a threat of distributed service denial (DDOS) which does not require clicks to activate. Attackers can paralyze critical systems, including domain controllers (DC), which could completely destabilize an organization.
A very serious problem to solve as soon as possible
The back attacks focus on uncontrolled consumption of resources, an approach that allows attackers to drop any termination point or Windows server. The most disturbing technique, known as Win-Ddos, exploits a vulnerability in the reference process of the LDAP customer of Windows, allowing attackers to redirect DCs to a victim server and to ensure that they repeat this action indefinitely. This results in the creation of a massive and unsporable Botnet DDOS, using public DCs around the world.
The implications of these discoveries are critical, since domain controllers are essential for authentication and resource management in organizational networks. A successful attack may mean that users cannot access their resources, thus paralyzing daily operations. In addition, researchers have identified three new back vulnerabilities that can be used without user interaction, affecting both servers and termination points.
Although Microsoft has published corrective for vulnerability Ldapnumemare, This new series of vulnerabilities highlights the need for organizations to review and strengthen their security postures, in particular with regard to internal systems such as DCS. Continuous vigilance is essential to protect against these emerging threats.
