SH1MMER - Exploit for ChromeOS discovered to unenroll managed ChromeOS devices

[Zoom7000]

A pretty serious exploit seems to have been discovered for ChromeOS. It's called SH1MMER. There's a little bit of information on their official website (sh1mmer.me).

 

What is SH1MMER?

SH1MMER is an exploit capable of completely unenrolling enterprise-managed Chromebooks. It was found by the Mercury Workshop team and was released on January, Friday the 13th, 2023.

 

It appears to have been discontinued as a tool, but the expliot is still out there and as of today (19th January) still unpatched.

 

Response from Google on sh1mmer.

 

Google is aware of an issue affecting a number of ChromeOS devices, which requires Google to collaborate with ecosystem partners on a fix. User data on impacted devices is not exposed. As a security best practice, we recommend Enterprise and Education administrators monitor for unenrolled and inactive ChromeOS devices.

 

There are mitigation steps customers can take to reduce user access to the exploit tools (some of which have been suggested by the sysadmin community) including:

 

* Continually monitor for inactive devices in the admin console. Contact users whose devices have not synced within an unusual amount of time (last policy sync)

 

* Turn off enrollment permissions for most users. This will require users to identify themselves in order to properly re-enroll a device that was unenrolled.

 

* Block access to the Chromebook Recovery Utility extension on as many user devices as possible (even non-ChromeOS), since this tool is required as part of the exploit.

 

* On managed Chromebooks, block access to chrome://net-export so that users cannot capture wireless credentials.

* Block access to the following web sites that have been used to spread exploit tools and information using URLBlocklist as well as via content filtering products:

 

sh1mmer.me

alicesworld.tech

luphoria.com

bypassi.com

 

Please do not hesitate to reach out with any questions. We realize this is challenging in the field. Thank you for your continued collaboration.

Edited January 19, 2023 by Zoom7000