Slashdot Mirror
Windows UAC Bypass Permits Code Execution (threatpost.com)
msm1267 writes from a report via Threatpost: A Windows UAC bypass has been publicly disclosed that not only bypasses the security feature meant to prevent unauthorized installs, but can be used to run code on compromised machines without leaving a trace on the hard disk. The bypass relies on Event Viewer (eventvwr.exe), a native Windows feature used to view event logs locally or remotely. Researcher Matt Nelson said he figured out a way to use eventvwr to hijack a registry process, start Powershell and execute commands on Windows machines; he collaborated with fellow researcher Matt Graeber on a proof-of-concept exploit, which was tested against Windows 7 and 10. A report published today by Nelson said it would work against any version of the OS that implements UAC. An attacker would already need to be on the machine to use this technique, Nelson said. The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action via the UAC pop-up. Microsoft, the researcher said, does not consider UAC bypasses a security boundary worthy of a bulletin and patch. It's unclear how Microsoft will address this issue.
Easier to just rely on the luser to click "Allow" when the UAC prompt pops up.
CLI paste? paste.pr0.tips!
The sky is blue, water is still wet, and windows is still insecure. Wonder if Microsoft is colluding with the 3rd party software market to keep windows insecure? Would make for some nice kickback payoffs from the Anti-virus / Anti-malware vendors. Winception.... How deep down the money hole does it go.
Let's not worry about this right now. We need to get back to important topics... like Cortana, and how that bitch is going to save starving children in Africa. And Slashdot FBI. Can't forget Slashdot FBI.
>It's unclear how Microsoft will address this issue.
They already did. They had the FBI post how it is "somebody else bypassing the installer" besides Microsoft.
>bypasses the security feature meant to prevent unauthorized installs
There is only one feature to install in Windows. That is called Do you want to be spied on today.dll
Give it up FBI. Look at the fucking stupid sites it quotes in the summary.
threatpost.com
enigma0x3.net
Don't even click on the second one. Anybody who has been using the Internet for decades knows where to find valid bugs. That shit ain't it son.
One has to realize that the FBI now at Slashdot, never were Slashdotters before.
An attacker would already need to be on the machine to use this technique, Nelson said. The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action
So the attacker already pwns the machine. This is a threat?
UAC isn't intended to be some kind of inviolable security mechanism. It's more of a simple alert that some process is trying to make changes to your system - a nice thing to know if you weren't expecting it. The fact that you can bypass the UAC prompt when already on the computer with administrative rights is pretty non-consequential.
The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action via the UAC pop-up.
Thank goodness! I've been looking for a way around those annoying popups ever since they first arrived in Windows, and I know I'm not the only one.
Secession is the right of all sentient beings.
Where do you get YOUR torrents from, friends?
UAC has a different goal than you think.
https://channel9.msdn.com/Forums/Coffeehouse/473037-UAC-controversy-the-last-episode/773c9d79f8df4fa8bc489deb00e05c3d
Its goal is to force us to actually fix our crap. UAC is not a bandaid to fix all security issues. There are many known work arounds to it. Including turning it off.
All you folks still running Windows XP and being told it's a pile of insecure horseshit are vindicated!
Now known as Losedows Adversary 11
If this exploit requires admin rights on the box, then this is pointless. The box is already compromised and you have bigger issues.
Who in their right mind runs Admin and turns off UAC? You deserve malware if your doing that.
If your current user isn't an Administrator, this doesn't provide the attacker any additional privileges.
UAC was never about security. It was about covering one's ass. "You can't blame Microsoft. We showed you a confirmation prompt and you clicked yes."
So called 'Windows Experts' know how they like their systems and disable UAC as one of the first things they do when setting up a system. To them I laugh when they call themselves 'Experts', especially in the security area.
Admin privileges?, Physical access?, big meh.
Seems newsworthy.
No. I hope you do not. I don't run as admin on my Windows machines either. I run as Standard User so even if something bypasses UAC it can't do much because my account simply doesn't have those rights.
Elevation from limited-user access to "root" (Administrators-level access) is definitely a threat. Of course, in this case, it's just enabled by a really moronic default that Microsoft added to UAC in Win7 (and has persisted since), which auto-elevates some "trusted" Windows binaries (like eventvwr.exe). If you remove that particular stupidity (in the UAC control panel, move the slider all the way up to "Always Notify"), this attack (and the long, long list of similar things, many known for years, like it) won't work.
There's no place I could be, since I've found Serenity...
A security boundary not worth considering? For real? UAC and FS/registry virtualization are the only OS-level security paradigms added to Win 7 over Win XP. Without it, any background process running with administrative privileges can do what a logged-in administrator can do. This includes installing new software and doing essentially anything that a local TrustedInstaller user can do. Worse yet, if this ever happens when an admin user is logged in, the process would not even need to authenticate itself. It would just run it in the session of the logged-in admin user without the admin user ever knowing about it, with the admin user's full confidence that nothing can installed under his credentials (because he has UAC turned on and not allowing any installation to happen without first presenting a "may I, mother?" prompt). If they don't think the session security improvements are worth anything, why don't just start to openly support Win XP again? This is somewhat disturbing.
Any guest worker system is indistinguishable from indentured servitude.
Not quite physical access. He just needs an admin to log in. So there is an admin user session running.
Any guest worker system is indistinguishable from indentured servitude.
OK, 7-digit ID or not, are you really so new here you think that Slashdot summaries (or even articles) are an always-accurate representation of the world? Out here in the real world, where I've been working in information security longer than you've been on this site (and nearly as long as I have, actually), we understand the difference between "the attacker needs to physically or remotely accessing the machine" and "the attacker needs to have code executing on the machine". It's a very important difference. The fact that the summary implies direct access is required is stupid, but the fact that you (and, apparently, a significant number of other people) took that implication as fact says much more about you all than it does about the exploit.
Try reading the actual exploit writeup rather than dumbed-down ThreatPost article, and you'll see that no such claim is made. There's not a single step of the process that requires the level of access you'd need to approve a UAC prompt. Hell, even in the ThreatPost article, it doesn't say (or even imply) anything about physical access.
You can do this exploit if you get non-elevated arbitrary code execution (via remote compromise, or Trojan download, or anything else of that sort) in the account of a member of the Administrators group. You cannot click "Allow" via non-elevated code execution; UAC is very carefully designed to not allow non-elevated code to approve its prompts.
Please don't run your mouth when you don't know what you're talking about. This exploit, and the UAC default in Win7+, are both stupid enough already; you don't have to turn it into a three-way race. Think first, then post!
There's no place I could be, since I've found Serenity...