Security · High impactFan score 47 · Tier B3 sources
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
SecurityWeek · By Ionut Arghire ·
The Brief · written from 3 sources
- Researcher Abdelhamid Naceri (Nightmare Eclipse) released a public Windows zero-day exploit called SignDrop
- The exploit claims a local user can gain SYSTEM privileges through the Common Log File System driver (clfs.sys)
- The proof of concept abuses a log-authentication feature added to the CLFS driver last year
Why it matters
Public exploit code for a local privilege escalation in a core Windows driver means any attacker who already has local user access on a Windows machine could potentially take full SYSTEM control.
Who’s affected
- Windows administrators
- Organizations running Windows systems with local user access
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process. The post Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’ appeared first on SecurityWeek .
Timeline
BleepingComputer and The Hacker News report public release of SignDrop zero-day exploit code
BleepingComputer
New Windows SignDrop zero-day gives hackers SYSTEM privileges
The Hacker News
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
SecurityWeek
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
Full coverage · 3 sources
- 1h ago ↗
SecurityWeek
Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’
- 16h ago ↗
- 18h ago ↗
BleepingComputer
New Windows SignDrop zero-day gives hackers SYSTEM privileges