News for hackers. Stuff that matters.

A comment on Zero-click, wormable, cross-platform remote code execution in Microsoft Teams. Parent comment

Re:Zero-click, wormable, cross-platform remote code executio... by tclancy on Monday December 07, 2020 @10:30AM (#25333054)
Is there any tell-tale sign this happened to you? I had a really weird experience on Mac last week: I opened up my machine and when I focused on teams I got a security alert saying something called Endgame from Elastico was demanding permissions. Never downloaded it but there it was in Applications.
[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by eqvinox on Monday December 07, 2020 @10:41AM (#25333185)
It is technically never possible to guarantee tell-tale signs of an RCE. At the point where you're running compromised code, that code could in most cases be constructed as to erase its own tracks. There might be some visible sign at the moment of exploitation, but after that it's kinda over.

(Yes this assumes the RCE escalates to a reasonably high privilege, but that's just a matter of chaining. You can try to go for things like sealed logs, but ultimately arbitrary code can put your machine in an arbitrary state.)

Particularly insidious for this would be the case of data theft. The RCE might load some code to upload your company secrets and keep itself strictly in RAM, and then erase itself when done. With enough blackhat craftiness you'd never be able to pinpoint the exact location of the leak.

[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by hundchenkatze on Monday December 07, 2020 @11:30AM (#25333685)
If you're using an employer provided computer then they've likely installed Endgame[0] which is an endpoint (it runs on each device) security tool. Endgame was acquired by Elastic[1] last year

[0] https://en.wikipedia.org/wiki/Endgame,_Inc.

[1] https://en.wikipedia.org/wiki/Elastic_NV

[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by sigotirandolas on Monday December 07, 2020 @12:51PM (#25334726)
Fixed link: https://en.wikipedia.org/wiki/Endgame,_Inc%2E
[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by gnfargbl on Monday December 07, 2020 @11:01AM (#25333397)
Is this a work Mac? If so then it is likely managed through some kind of MDM system (JAMF etc), and it wouldn't be unreasonable for the owner of the hardware to be pushing down an endpoint agent like Elastic Endgame. Check in with your security team and ask them.
[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by oskarsv on Monday December 07, 2020 @10:36AM (#25333141)
no, as you can see in the first demo it could be completely silent.

not saying you are safe - I don’t know :)

[ Parent | on HN ]