Attack Chain

1. Attacker gains local access to the target system.
2. Attacker identifies the vulnerable service, IObitUnSvr, and its unquoted service path.
3. Attacker places a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory.
4. Attacker restarts the IObitUnSvr service. This can be achieved through the Services control panel (services.msc) or via command-line tools like net stop IObitUnSvr followed by net start IObitUnSvr.
5. Due to the unquoted service path, when the service attempts to start, Windows executes the attacker-controlled IObit.exe with SYSTEM privileges.
6. The malicious IObit.exe performs actions as the SYSTEM user, granting the attacker elevated control over the system.
7. Attacker leverages elevated privileges to install malware, modify system configurations, or exfiltrate sensitive data.

Impact

Successful exploitation of this vulnerability allows a local attacker to escalate their privileges to SYSTEM. This can lead to complete compromise of the affected system, allowing the attacker to install programs, view, change, or delete data, or create new accounts with full administrative rights. There is no specific information about observed damage or targeted sectors included in this report.

Recommendation

• Apply the Sigma rule Detect IObit Uninstaller Unquoted Service Path Privilege Escalation to detect the creation of a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory.
• Apply the Sigma rule Detect IObitUnSvr Service Start with Malicious Executable to detect when the IObitUnSvr service starts a malicious executable due to the unquoted service path.
• Upgrade IObit Uninstaller to a version that addresses CVE-2020-37223.