The PhantomRPC vulnerability allows hackers to take control of the server system.

Kaspersky has just discovered PhantomRPC, a vulnerability in the Remote Procedure Call (RPC) mechanism on Windows, stemming from the system's design characteristics and which can be exploited by hackers to impersonate servers and gain access.

PhantomRPC is a vulnerability in the Remote Procedure Call (RPC) mechanism of Windows.

Kaspersky experts say this vulnerability doesn't stem from a specific error but from how the system operates, allowing hackers to exploit it to escalate access directly on the system. In the case of a process with impersonation, an attacker could leverage this to gain system-level control.

How Microsoft's remote communication mechanism works.

Kaspersky analyzed five different exploit scenarios, showing that hackers could escalate access from local or network-related services to higher levels, even gaining control of the system. Because the problem stems from a design flaw, this vulnerability opens up almost countless attack methods. Any new process or service that uses remote communication mechanisms (RPC) could become a new exploitation point for extending access.

Haidar Kabibo, an application security specialist at Kaspersky, stated: “The specific exploitation methods can vary depending on the system, depending on factors such as the installed software, the Dynamic Link Libraries involved in the remote communication mechanism, and whether the corresponding remote communication application servers are available. This variation makes vulnerabilities a critical factor in businesses’ risk assessment and response strategies.”

Kaspersky recommends that organizations implement measures to detect and mitigate exploitation risks: Implement ETW-based monitoring, which allows security teams to identify anomalies in remote communication mechanisms within the system environment, especially when connection requests are made to non-existent or unavailable servers. Restrict the use of SeImpersonatePrivilege; this privilege should only be granted to processes that truly need it.

BINH LAM

Source: https://www.sggp.org.vn/lo-hong-phantomrpc-cho-phep-tin-tac-chiem-quyen-he-thong-may-chu-post851434.html