What we found is that a threat actor can write malicious code into an atom table and force a legitimate program to retrieve the malicious code from the table. We also found that the legitimate program, now containing the malicious code, can be manipulated to execute that code.
Related slides: http://mista.nu/research/smashing_the_atom.pdf
Here’s a new code injection technique, dubbed AtomBombing, which exploits Windows atom tables and Async Procedure Calls (APC). Currently, this technique goes undetected by common security solutions that focus on preventing infiltration
Since the issue cannot be fixed, there is no notion of a patch for this. Thus, the direct mitigation answer would be to tech-dive into the API calls and monitor those for malicious activity.
Q: Would it slow down the machine if the AV would monitor API calls? Is AtomBombing more serious than a DLL Injection? Is it true that it cannot be fixed? Is this something new or just an old thing written in a blog nowadays that was tested in win10 but previously known?