Slashdot Mirror
Researchers Bypass IE Protected Mode
Trailrunner7 writes "A new paper from researchers at Verizon Business identifies a method through which an attacker can bypass Internet Explorer Protected Mode and gain elevated privileges once he's successfully exploited a bug on the system. Protected Mode in Internet Explorer is one of a handful of key security mechanisms that Microsoft has added to Windows in the last few years. It is often described as a sandbox, in that it is designed to prevent exploitation of a vulnerability in the browser from leading to more persistent compromise of the underlying system. In their research, the Verizon Business team found a method that, when combined with an existing memory-corruption vulnerability in the browser, enables an attacker to bypass Protected Mode and elevate his privileges on the compromised machine (PDF). The technique enables the attacker to move from a relatively un-privileged level to one with higher privileges, giving him complete access to the logged-in user's account."
Seen it before.
It's Windows and it's IE. They have had a long time to create a reputation for security issues. This comes as just another fail behind a long long long string of fails. Face it, it's time to throw the code out and start fresh.
Seriously, protected mode does nothing more than throw a UAC "Are you sure you want to do this?" prompt at the user, which nearly all of the users I know would click right past. Unlike UAC, you can't configure it to ask for an administrator username and password, or even configure it to never allow changing integrity levels.
It was already easily bypassed anyway, by design. Showing a vague warning to a non-savvy user and hoping they don't click OK isn't security.
How do i know that pdf isn't maliciously crafted to infect my system.
Html and css people, it's what is made for presentation of content on multiple systems. Why don't you use those tags and specify different styles for display,print and what-have-you
We hear about vulnerabilities involving services and programs that the majority of internet consumers use everyday on a constant basis; it's pretty much expected...not just from pre-installed Windows applications like Internet Explorer, but from GMail, Facebook, Twitter, Wordpress etc. By contrast, when was the last time you heard of a Filemaker exploit, a malicious Opera toolbar, an identica worm, or someone having their Fastmail hacked? Good services with solid support that aren't used by the clueless masses are probably the best way to go when deciding what online applications to patronize.
Have you ever looked at a real life sandbox, that kids have been playing in? Notice how there's sand scattered all over the surrounding ground up to six feet away from the box? That's Microsoft's security model right there.
Like I'm really going to open up an untrusted PDF file. In other news "Virus destroys computers, open up attached exe for demonstration...."
Does anyone honestly trust IE these days?
Actually, the whole point of a sandbox is to make it so that crackers cannot punch through the wall, even if they compromise a given application.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
The keyword is trust. While you are free to be so paranoid that you don't trust Verizon's researchers, most of us have a realistic trust model, and consider it to be a trusted resource.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
An IE exploit giving admin status on a Windows machine, color me shocked!
Its not Microsoft's fault but people are jumping to blame them, its ADOBE, the reason for security problems on the web.
Umm, doesn't the enhanced access design of Sliverlight 5 DEPEND upon this Protected Mode?
For once, Microsoft lack of secure design can be demonstrated before anybody can get their hands on it.
(more detail)
"mai kumpootur haz mutch virii!"
Wasn't sure whether you knew. Just posting this as a PSA.
You are dead wrong. In the real world, with physical security, people have long had to understand there is no perfect, unbreakable, security. It just cannot happen. the best locks in the world can be picked, the most trained guards can be killed, the strongest materials can be cut. There is no such thing as the one item, one method, etc that cannot be broken so you just implement that can call it good. As such you must build security that has defense in depth, multiple layers that if one is bypassed or fails the other can keep things secure. You also have to be vigilant, watching things to make sure they are secure and fixing problems. That is just what security is.
Computer people for some reason have convinced themselves that isn't true in the virtual world, that you can perfect, unbreakable security and that so long as you have one perfect item everything else is irrelevant. That's not the case.
So saying "This sandbox is not unbreakable," isn't lowering standards, it is being realistic. It is realizing that saying you've got something that is perfect is extremely arrogant and stupid. It is being aware that it is helpful to increase security but cannot be the only layer.
One is that they say "This attack assumes the existence of exploitable memory corruption vulnerability." As in this isn't something that actually works, it presumes you've already found an exploit. However I will grant them that is the kind of thing protected mode should help defend against (not stopping the bug from happening, but that it can't be used to do much).
However the bigger one is that it allows you to gain normal user privileges. You can break out of the low privilege for the app (that's what protected mode is, running at a lower privilege level than the user who ran it) in to the regular user, NOT an administrator. Thus what it does is make IE the same as every other browser, which do not make use of Mandatory Integrity Control. If you find an exploit in Firefox (and don't say there haven't been any, look at their patch history) or Chrome or whatever you are already at user privilege level since they do not use MIC to run at a lower level. This does not give admin privileges unless the user has either turned off UAC and logged in as an admin or run the browser with admin privileges.
So does it need to be fixed? For sure, and I'm sure it will be. However it is not an "OMG do this and you get admin through IE!" thing. It is "Supposing a proper kind of exploit is found in IE, which has not been done yet, you could use it to gain regular user access on a system instead of reduced access."
Also I'm not sure where you thing about "letting security fixes ripen" comes from. As far as I can tell this is a new paper. If you think they should have a fix out for something that was just announced, well then you've not done a lot of programming at least not on major projects. First off they have to figure out HOW to fix it. This isn't always simple. From reading the white paper it isn't just a case of "There's a buffer overflow," or something like that which is pretty simple. They may need to do some more significant changes. So once that is done you have to implement them, and then do a lot of testing. People get extremely whiny if a Windows update breaks something. They even whine about it when the reason somethign broke was that they had malware on their system. So MS has to do a massive set of testing to make sure it works with all sorts of hardware, drivers, apps, and so on.
I'm not saying MS is as fast as they should be with patches but the "PATCH NEXT DAY!" crowd needs to chill and realize the level of testing that is necessary.
I'm pretty sure it's better not to let language rot through poor grammar. So, please keep the protocol from being corrupted or unnecessarily fragmented. The more inaccurate languages get the more heat loss humanity suffers.
Maybe you don't think it matters much. Well, okay. But for those who think correctness and standards compliance are good, the correct plural of virus is offered.
No worries for the average user. Most people I talk to aren't even aware that there was a sandbox-option that could be used. So it's a hole in a door that nobody knew was there. Kinda philosophical: "If a sandbox was cracked that no-one knew existed, is it really cracked".
the use of knowledge is highly overrated
--------- http://www.jordaner.com ----------
JORDANER,Inc. We are the best online dealer,about all kinds of Nike shox .run retailing and wholesale trade wordwidely for years. Free S hipping And Customs,Super Sale Off Retailing,With 1Week Delivery to your door.
You are obviously correct. The Linux kernel team has a really bad security attitude. The fact that it is much more secure than Windows happens by magic. Have a nice life.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
The chromium sandbox design documents discuss how on Windows Vista and later different parts of the browser run with low integrity mode like IE 7+.
Right, I'm the idiot:
Yes, in the LKML do they state it. ROTFLMAO
I'm more of a "Linux is more secure because it is more secure" kind of guy.
Also, it has come to my attention that you are a known troll on Slashdot, so Plonk
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
http://yro.slashdot.org/comments.pl?sid=1888084&cid=34378092 and you called others here idiots? You're the idiot that ran when he was confronted on his trolling because you weren't able to dispute and disprove what was posted and you were asked to. You talk a big game metrix007, but you can't even show anyone here that you've done more than those you called "ignorant and misinformed" in that URL above. You're a noob, and we all know it, just based on that URL above.
http://yro.slashdot.org/comments.pl?sid=1888084&cid=34378092 You're the troll that ran when he was confronted on his trolling there in that URL I just put up, because you weren't able to dispute and disprove what was posted and you were asked to. You talk a big game metrix007, but you can't even show anyone here that you've done more than those you called "ignorant and misinformed" in that URL above. You're a noob, and we all know it, just based on that URL above as well as your repeated insults (obvious or attempted subtle ones) and name calling of others that is shown in your posting history here this week alone. Grow up, do something with your life, before you try to play "expert" with anyone here or elsewhere that have (which is what you tried above, and you ran, lol!).
http://yro.slashdot.org/comments.pl?sid=1888084&cid=34378092 You're the troll that ran when he was confronted on his trolling there in that URL I just put up, because you weren't able to dispute and disprove what was posted and you were asked to. You talk a big game metrix007, but you can't even show anyone here that you've done more than those you called "ignorant and misinformed" in that URL above. You're a noob, and we all know it, just based on that URL above as well as your repeated insults (obvious or attempted subtle ones) and name calling of others that is shown in your posting history here this week alone, like this one also. Grow up, do something with your life, before you try to play "expert" with anyone here or elsewhere that have (which is what you tried above, and you ran, lol!).