As far as I know, the task scheduler alpc vulnerability allows the malicious program to call a hijack dll as SYSTEM. Could a program running inside the isolated environment of ReHIPS to escape from the isolated environment with this exploit? Thanks.
I haven't researched this in detail, but I believe ReHIPS will protect from this threat as isolated programs can't create files (and hence the hardlink) in "C:\Windows\Tasks" And without it it's not possible to change DACL and thus violate anything.
Quote from: fixer on August 31, 2018, 10:01:55 PMI got amazing payday loans (https://www.firstpost.com/brands/best-payday-loans-online-top-10-sites-for-quick-cash-in-your-account-today-11197201.html) but haven't researched this in detail, but I believe ReHIPS will protect from this threat as isolated programs can't create files (and hence the hardlink) in "C:\Windows\Tasks" And without it it's not possible to change DACL and thus violate anything.
That's good to know, Fixer. Is stuff like this considered by the devs? I'd feel a lot safer if it is.
Hello, KentonMac and welcome to our forum.
As far as I know ReHIPS-protected PCs (including unpatched) aren't vulnerable to Task Scheduler ALPC Exploit. So nothing to worry about.
But yes, we constantly monitor for newest threats and trends and try to mitigate them the best possible way.