Researcher publishes PoC for new Windows zero-day

This is the third Windows zero-day the researcher dumps online in the last five months.

Researcher finds new zero-day Windows vulnerability, gets into trouble with FBI

A security researcher known only under the pseudonym of SandboxEscaper has published proof-of-concept code online for a new zero-day vulnerability affecting the Microsoft Windows operating system.

Acros Security CEO Mitja Kolsek confirmed the researcher's zero-day claim and the PoC's validity to ZDNet earlier today. This marks the third time this same researcher has posted a Windows zero-day online, after doing the same thing in August and October.

Very few technical details are available about this latest zero-day at the time of writing. The only thing known is that it impacts ReadFile, the de-facto Windows OS function for reading data from files and I/O device streams. According to a summary description provided by Kolsek, the zero-day "allows a low-privileged user to read any file that can be accessed by Local System account."

Several researchers who analyzed the zero-day this is also another elevation of privilege (EoP), a vulnerability that allows a user to gain access to functions and permissions available to higher user groups.

The two previous zero-days were also EoPs. The first one allowed an attacker to exploit the Advanced Local Procedure Call (ALPC) interface to get system privileges. The second zero-day affected the Microsoft Data Sharing (dssvc.dll) service to allow attackers to delete files that normal users wouldn't be able to interact with.

After publishing this third zero-day, the researcher's GitHub account was taken down shortly after. On her blog, the researcher accused Microsoft of taking down her GitHub account.

The researcher is also in legal hot water. Last week, the US Federal Bureau of Investigation (FBI) subpoenaed Google requesting details about her account.

The reasons are unknown, but there are several theories. One might be in regards to the researcher actively advertising zero-days online, offering to sell exploits even to foreign governments, which constitutes a violation of US software export laws.

The FBI legal request may also be in regards to a possible life and death issue. SandboxEscaper is also known to suffer for mental issues, sometimes posting messages about committing suicide.

Last but not least, the FBI might be seeking information about her identity after she briefly posted a death threat against US President Donald Trump on Twitter earlier this month, which eventually got her initial Twitter account suspended.

Article updated with YouTube video.

More cybersecurity coverage: