Hackers Hijack SentinelOne: How BYOI Became the EDR’s Achilles’ Heel
A new Bring Your Own Installer (BYOI) technique lets hackers bypass SentinelOne EDR’s anti-tamper protections by exploiting the upgrade process. This clever trick leaves systems exposed, allowing Babuk ransomware to invade faster than you can say “update.” Turns out, sometimes upgrading isn’t all it’s cracked up to be!
Hot Take:
Looks like SentinelOne’s EDR got caught napping! Who knew that the “Bring Your Own Installer” party would turn into a ransomware rave? When your security system’s upgrade process turns into a free-for-all, it’s time to update your party playlist and maybe your security protocols too!
Key Points:
- New BYOI technique exploits SentinelOne’s upgrade process to bypass EDR protections.
- Attackers disable protections and deploy Babuk ransomware without using malicious drivers.
- The vulnerability revolves around a mishandled local upgrade process.
- Stroz Friedberg’s experiment showed that interrupting an upgrade left systems unprotected.
- SentinelOne responded by issuing guidance and emphasizing the “Online authorization” feature.
Already a member? Log in here