| Name |
Hijacking a Privileged Thread of Execution |
|
| Likelyhood of attack |
Typical severity |
| Low |
Very High |
|
| Summary |
An adversary hijacks a privileged thread of execution by injecting malicious code into a running process. By using a privleged thread to do their bidding, adversaries can evade process-based detection that would stop an attack that creates a new process. This can lead to an adversary gaining access to the process's memory and can also enable elevated privileges. The most common way to perform this attack is by suspending an existing thread and manipulating its memory. |
| Prerequisites |
The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users In order to feasibly execute this class of attacks, the adversary must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or calling native OS calls that can suspend and alter process memory. This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute. |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Explore |
[Determine target thread] The adversary determines the underlying system thread that is subject to user-control |
|
| 2 |
Experiment |
[Gain handle to thread] The adversary then gains a handle to a process thread. |
- Use the "OpenThread" API call in Windows on a known thread.
- Cause an exception in a java privileged block public function and catch it, or catch a normal signal. The thread is then hanging and the adversary can attempt to gain a handle to it.
|
| 3 |
Experiment |
[Alter process memory] Once the adversary has a handle to the target thread, they will suspend the thread and alter the memory using native OS calls. |
- On Windows, use "SuspendThread" followed by "VirtualAllocEx", "WriteProcessMemory", and "SetThreadContext".
|
| 4 |
Exploit |
[Resume thread execution] Once the process memory has been altered to execute malicious code, the thread is then resumed. |
- On Windows, use "ResumeThread".
|
|
| Solutions | Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code. Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-270 |
Privilege Context Switching Error |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-233 |
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform. |
|
| Taxonomy: ATTACK |
|
Entry ID
|
Entry Name
|
| 1055.003 |
Process Injection:Thread Execution Hijacking |
|