Windows 10 will immediately begin displaying notifications prompting the user to restart their PC and repair the corrupted disk volume. So, I'll leave it to the people with the source code,' Jonas told BleepingComputer.Īfter running the command in the Windows 10 command prompt and hitting Enter, the user will see an error message stating, "The file or directory is corrupted and unreadable." 'I have no idea why it corrupts stuff and it would be a lot of work to find out because the reg key that should BSOD on corruption does not work. It is unclear why accessing this attribute corrupts the drive, and Jonas told BleepingComputer that a Registry key that would help diagnose the issue doesn't work. In some cases, the NTFS Index can also include deleted files and folders, which comes in handy when conducting an incident response or forensics. The Windows NTFS Index Attribute, or ' $i30' string, is an NTFS attribute associated with directories that contains a list of a directory's files and subfolders. *WARNING*Īn example command that corrupts a drive is shown below.
ONLY test this command in a virtual machine that you can restore to an earlier snapshot if the drive becomes corrupted. *WARNING*Executing the below command on a live system will corrupt the drive and possibly make it inaccessible. Jonas' tweet about a "critically underestimated" vulnerabilityĪ drive can become corrupted by merely trying to access the $i30 NTFS attribute on a folder in a certain way. What's worse is, the vulnerability can be triggered by standard and low privileged user accounts on Windows 10 systems. The researcher told BleepingComputer that the flaw became exploitable starting around Windows 10 build 1803, the Windows 10 April 2018 Update, and continues to work in the latest version. When exploited, this vulnerability can be triggered by a single-line command to instantly corrupt an NTFS-formatted hard drive, with Windows prompting the user to restart their computer to repair the corrupted disk records. In August 2020, October 2020, and finally this week, infosec researcher Jonas L drew attention to an NTFS vulnerability impacting Windows 10 that has not been fixed. "Critically underestimated" NTFS vulnerability In multiple tests by BleepingComputer, this one-liner can be delivered hidden inside a Windows shortcut file, a ZIP archive, batch files, or various other vectors to trigger hard drive errors that corrupt the filesystem index instantly. An unpatched zero-day in Microsoft Windows 10 allows attackers to corrupt an NTFS-formatted hard drive with a one-line command.
0 kommentar(er)
