⬇ Download holy card: ·
⚔ Commemorated today: The Scourge of SamSam in Atlanta (2018)Blessed DoubleAgent, Who Played Both Sides
Patron of antivirus software, debugging tools forgotten in the system, and spies who serve two masters.
Life
On 22 March 2017 researchers at Cybellum presented DoubleAgent, a technique that abused Microsoft Application Verifier, a debugging tool built into Windows, to make any process load a DLL of the attacker's choosing, even after a reboot. The juiciest target was antivirus software: according to the researchers, products from many well-known vendors could be turned into agents working for the attacker. It did, however, require administrative control of the machine already, and some pointed out the idea had been shown at conferences as early as 2015.
Prayer
O Blessed DoubleAgent, who knows how to wear the guard's uniform, let our antivirus serve one master only. Amen.
How to celebrate
Celebrated by updating antivirus to versions that protect their own processes, watching the Image File Execution Options registry keys, and handing out admin rights by the drop.
A bribed guard is an open door.