A new vulnerability in Windows called BlueHammer can lead to complete system takeover, according to researchers.
The vulnerability, BlueHammer, was shared by a researcher who is dissatisfied with how Microsoft handled the report. Since no security update exists yet, the flaw is considered a zero-day. This means that systems are currently vulnerable without an immediate solution.
From limited access to full control
BlueHammer is a local privilege escalation vulnerability. Attackers must first gain access to a system, but can then elevate their privileges to administrator or even SYSTEM level.
The vulnerability combines techniques including a time-of-check-to-time-of-use (TOCTOU) error and path confusion. This allows attackers to gain access to sensitive components such as the Security Account Manager (SAM) database, where encrypted passwords are stored. If attackers reach that point, they can take full control of the system.
Waiting for a patch
For companies, this primarily means increased vigilance. Without a patch, they are limited to general security measures, such as restricting local access and quickly detecting suspicious activity. An official fix from Microsoft has yet to be released.