FalconFlank Turns the Bodyguard Into the Burglar

a researcher just published a working exploit to turn crowdstrike falcon, the software meant to protect a windows machine, into a tool for taking it over.

there is an important caveat. falconflank does not get you onto the machine in the first place. you already need low-privileged local access. what it gives you is the privilege escalation from ordinary user to system level access.

falconflank abuses a legitimate falcon feature, one designed to strip malicious macros out of office documents. that cleanup runs with high privileges because it has to. the exploit tricks the machine into handing a low-privileged user a system-level command prompt. you do not break falcon. you merely borrow its privileges.

to keep it straight, there is no cve yet and it is not being exploited in the wild. it is a proof-of-concept with public code. and crowdstrike has already issued a mitigation, advising customers to disable the microsoft office file suspicious macro removal policy while it investigates. cloud anti-malware for office files remains available.

and it is not just crowdstrike. the same researcher hit kaspersky, avast, and defender the same way in the same few weeks. security tools run with the deepest access on your machine by design. so if one gets turned, it does not just fail. it hands over the keys it was already holding.

endpoint security is not sitting outside the operating system watching it through binoculars. it is buried deep inside the trust model, running with the authority to inspect, modify, quarantine, and remediate almost anything.

every extra privilege you give the defender becomes a privilege an attacker may eventually try to leverage.