A researcher feuding with Microsoft has published SignDrop, a Windows zero-day (a flaw disclosed with no fix available) that lets a local user take full System rights.
The researcher goes by Nightmare Eclipse, a pseudonym, and disclosed the bug on Tuesday. It is the latest zero-day from the same person, who has an ongoing and very public beef with Microsoft. The flaw sits in the Common Log File System (CLFS), which Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode." It affects some versions of Windows.
The attack works by turning a defense against itself. An attacker with ordinary user rights forces a privileged process, such as Windows Defender, to open a crafted CLFS container, which is a log file the attacker created. The exploit gets Defender to do this by calling ServerMpUpdateEngineSignature, a legitimate Defender function for processing antivirus signature updates. Defender then creates files with its own elevated privileges, and the attacker abuses that to reach System, the highest privilege level on a Windows machine.
The word "local" limits the damage. An attacker must already be running code on the machine, so SignDrop is a second-stage tool rather than a way in. Second-stage tools still matter, because they turn a minor foothold into full control.
The disclosure also skips the usual order of events. Under coordinated disclosure, a vendor gets time to ship a fix before details go public. A zero-day drop hands defenders and attackers the same starting line.
The attack depends on three pieces interacting: CLFS, Defender, and Windows file permissions. Which of the three Microsoft decides to change is the open question.