• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

Qilin ransomware claimed responsibility for the attack on the beer giant Asahi

 | 

DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape

 | 

DraftKings thwarts credential stuffing attack, but urges password reset and MFA

 | 

Redis patches 13-Year-Old Lua flaw enabling Remote Code Execution

 | 

U.S. CISA adds Synacor Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

 | 

GoAnywhere MFT zero-day used by Storm-1175 in Medusa ransomware campaigns

 | 

CrowdStrike ties Oracle EBS RCE (CVE-2025-61882) to Cl0p attacks began Aug 9, 2025

 | 

Discord discloses third-party breach affecting customer support data

 | 

Oracle patches critical E-Business Suite flaw exploited by Cl0p hackers

 | 

LinkedIn sues ProAPIs for $15K/Month LinkedIn data scraping scheme

 | 

Zimbra users targeted in zero-day exploit using iCalendar attachments

 | 

Reading the ENISA Threat Landscape 2025 report

 | 

Ghost in the Cloud: Weaponizing AWS X-Ray for Command & Control

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 65

 | 

Security Affairs newsletter Round 544 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

GreyNoise detects 500% surge in scans targeting Palo Alto Networks portals

 | 

U.S. CISA adds Smartbedded Meteobridge, Samsung, Juniper ScreenOS, Jenkins, and GNU Bash flaws to its Known Exploited Vulnerabilities catalog

 | 

ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims

 | 

ProSpy, ToSpy malware pose as Signal and ToTok to steal data in UAE

 | 

Google warns of Cl0p extortion campaign against Oracle E-Business users

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Hacking
  • BadTunnel attack could have the widest impact in the history of Windows

BadTunnel attack could have the widest impact in the history of Windows

Pierluigi Paganini June 21, 2016

A Chinese security researcher has discovered a Windows design flaw dubbed BadTunnel that affects all versions of Windows.

The Chinese researcher Yang Yu, director of Xuanwu Lab of Tencent has discovered a design flaw in Microsoft Windows that affects all versions of the popular operating system. The vulnerability could allow an attacker to hijack a target organization’s network traffic, experts at Microsoft called it BadTunnel.

The expert will provide more details on the BadTunnel flaw at the next Black Hat USA that will be held in Last Vegas in August, “BadTunnel: How Do I Get Big Brother Power?” is the title of the announced presentation.

Microsoft has already patched the BadTunnel that according to Yang Yu has the widest impact in the history of Windows.

Yu told to DarkReading that the flaw affects all the Microsoft Windows versions and it could be silently exploited through many different channels. BadTunnel can be triggered via all versions of Microsoft Office, Edge, Internet Explorer, via IIS and Apache Web servers, via a thumb drive, and also through a number of third-party apps on Windows.

The BadTunnel results from a combination of issues that could allow attackers to launch an exploit.

“This vulnerability is caused by a series of seemingly correct implementations, which includes a transport layer protocol, an application layer protocol, a few specific issue for an exploit.” Yu explained to DarkReading “This vulnerability is caused by a series of seemingly correct implementations, which includes a transport layer protocol, an application layer protocol, a few specific usage of application protocol by the operating system, and several protocol implementations used by firewalls and NAT devices,” 

The expert classified the BadTunnel as a technique for NetBIOS-spoofing across networks, this means that the attacker can leverage on it to get access to network traffic without being on the victim’s network. The technique is very insidious and difficult to the attack is difficult to detect because it doesn’t involve malicious code and allows to bypass firewall and Network Address Translation (NAT) devices.

BadTunnel flaw

The attack scenario is very simple, the attacker just needs to trick victims into visit a malicious web page via IE or Edge, or to open a specifically crafted Office document. The website used by the attackers will appear as either a file server or a local print server, meantime it will allow the hijacking of the victim’s network traffic.

Then all the victim’s traffic is hijacked, including Windows Updates and Certificated Revocation List updates.

Below the attack scenario described by Yu:

  • Alice and Bob can be located anywhere on their network, and have firewall and NAT devices in-between, as long as Bob’s 137/UDP port is reachable by Alice.
  • Bob closes 139 and 445 port, but listens on 137/UDP port.port, but listens on 137/UDP port.
  • Alice is convinced to access a file URI or UNC path that points to Bob, and another hostname based URI such as “http://WPAD/x.jpg” or “http://FileServer/x.jpg”. Alice will send a NBNS NBSTAT query to Bob, and also send a NBNS NB query to the LAN broadcast address.
  • If Bob blocks access to 139 and 445 port using a firewall, Alice will send a NBNS NBSTAT query after approximately 22 seconds. If Bob instead closed 139 and 445 port by disabling Server Windows service or NetBIOS over TCP/IP protocol, Alice donot needdo to wait for connection to time sendout before the query.
  • When Bob received NBNS NBSTAT query sent by Alice, Bob forge a NBNS NB response by predicting the transaction id, and send to Alice. If a heartbeat packet is sent every few second, most firewall and NAT devices will keep the 137/UDP<->137/UDP tunnel open.
  • Alice will now add the resolved address sent by Bob to the NBT cache. The default TTL for NBT cache entry is 600 seconds.
  • Bob then hijacks Alice’s network traffic by posing as a Web Proxy Auto-Discovery Protocol (WPAD) or Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) server. WPAD hijacking is nothing new, Yu notes: HD Moore & Valsmith presented research on this in 2007 at Black Hat USA, and the Flame worm employed a similar attack method.

[adrotate banner=”9″]

Pierluigi Paganini

Security Affairs – (BadTunnel, Microsoft Windows )


facebook linkedin twitter

BadTunnel Hacking Hijacking Microsoft Windows

you might also like

Pierluigi Paganini October 08, 2025
Qilin ransomware claimed responsibility for the attack on the beer giant Asahi
Read more
Pierluigi Paganini October 08, 2025
DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    Qilin ransomware claimed responsibility for the attack on the beer giant Asahi

    Cyber Crime / October 08, 2025

    DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape

    Cyber Crime / October 08, 2025

    DraftKings thwarts credential stuffing attack, but urges password reset and MFA

    Security / October 08, 2025

    Redis patches 13-Year-Old Lua flaw enabling Remote Code Execution

    Security / October 08, 2025

    U.S. CISA adds Synacor Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

    Hacking / October 07, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT