Blessed DoubleAgent, Who Played Both Sides

Patron of antivirus software, debugging tools forgotten in the system, and spies who serve two masters.

Life

On 22 March 2017 researchers at Cybellum presented DoubleAgent, a technique that abused Microsoft Application Verifier, a debugging tool built into Windows, to make any process load a DLL of the attacker's choosing, even after a reboot. The juiciest target was antivirus software: according to the researchers, products from many well-known vendors could be turned into agents working for the attacker. It did, however, require administrative control of the machine already, and some pointed out the idea had been shown at conferences as early as 2015.

Prayer

O Blessed DoubleAgent, who knows how to wear the guard's uniform, let our antivirus serve one master only. Amen.

How to celebrate

Celebrated by updating antivirus to versions that protect their own processes, watching the Image File Execution Options registry keys, and handing out admin rights by the drop.

A bribed guard is an open door.