Slashdot Mirror
Windows UAC Bypass Permits Code Execution (threatpost.com)
msm1267 writes from a report via Threatpost: A Windows UAC bypass has been publicly disclosed that not only bypasses the security feature meant to prevent unauthorized installs, but can be used to run code on compromised machines without leaving a trace on the hard disk. The bypass relies on Event Viewer (eventvwr.exe), a native Windows feature used to view event logs locally or remotely. Researcher Matt Nelson said he figured out a way to use eventvwr to hijack a registry process, start Powershell and execute commands on Windows machines; he collaborated with fellow researcher Matt Graeber on a proof-of-concept exploit, which was tested against Windows 7 and 10. A report published today by Nelson said it would work against any version of the OS that implements UAC. An attacker would already need to be on the machine to use this technique, Nelson said. The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action via the UAC pop-up. Microsoft, the researcher said, does not consider UAC bypasses a security boundary worthy of a bulletin and patch. It's unclear how Microsoft will address this issue.
Easier to just rely on the luser to click "Allow" when the UAC prompt pops up.
CLI paste? paste.pr0.tips!
Never attribute to malice that which may be explained by incompetence. (it's usually the latter)
An attacker would already need to be on the machine to use this technique, Nelson said. The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action
So the attacker already pwns the machine. This is a threat?
UAC isn't intended to be some kind of inviolable security mechanism. It's more of a simple alert that some process is trying to make changes to your system - a nice thing to know if you weren't expecting it. The fact that you can bypass the UAC prompt when already on the computer with administrative rights is pretty non-consequential.
The attack allows an admin user to execute code in a high-integrity context without requiring the user to approve the administrative action via the UAC pop-up.
Thank goodness! I've been looking for a way around those annoying popups ever since they first arrived in Windows, and I know I'm not the only one.
Secession is the right of all sentient beings.
The sky is blue, water is still wet, and windows is still insecure.
The sky is blue, water is still wet, and windows is still INTENTIONALLY insecure.
ftfy.
It has nothing to do with third party software makers as you put it. It is US government spying apparatus. So are Google and Facebook and Twitter and Cloudflare (yeah, those captchas), and Markmonitor and way more. (Slashdot is just HUMINT which is normally out of FBI area of expertise... they are SIGINT. This is why they look so stupid here.)
The US Gov forced Microsoft into spy servitude way back when they threatened to split Microsoft into two companies (and worse, but not published). So you have what you have right now.
Spies everywhere, protecting nothing, producing nothing, just buying sunglasses and hair grease looking slimy in Nordstrom Rack attire.
UAC has a different goal than you think.
https://channel9.msdn.com/Forums/Coffeehouse/473037-UAC-controversy-the-last-episode/773c9d79f8df4fa8bc489deb00e05c3d
Its goal is to force us to actually fix our crap. UAC is not a bandaid to fix all security issues. There are many known work arounds to it. Including turning it off.
All you folks still running Windows XP and being told it's a pile of insecure horseshit are vindicated!
Unless they just want you to think its incompetence. Plausible deniability is all the rage.
If your current user isn't an Administrator, this doesn't provide the attacker any additional privileges.
Admin privileges?, Physical access?, big meh.
No it is about forcing developers to stop being fucking lazy C@#nts and demanding admin privileges when they are not necessary. apps that annoy users with prompts lose users and hence finally fix their shit that no amount of begging has been able to achieve.
Seems newsworthy.
No. I hope you do not. I don't run as admin on my Windows machines either. I run as Standard User so even if something bypasses UAC it can't do much because my account simply doesn't have those rights.
That is called Do you want to be spied on today.dll
I especially like the spaces in the file name. It really makes you feel on Windows.
Everything I write is lies, read between the lines.
Elevation from limited-user access to "root" (Administrators-level access) is definitely a threat. Of course, in this case, it's just enabled by a really moronic default that Microsoft added to UAC in Win7 (and has persisted since), which auto-elevates some "trusted" Windows binaries (like eventvwr.exe). If you remove that particular stupidity (in the UAC control panel, move the slider all the way up to "Always Notify"), this attack (and the long, long list of similar things, many known for years, like it) won't work.
There's no place I could be, since I've found Serenity...
I have yet to understand if cloudfare captchas are there to secure their service or to force us to downgrade our security, activating Javascript. It is a pity, because I had a very nice opinion of Cloudfare and recommend it several times before finding about that.
A security boundary not worth considering? For real? UAC and FS/registry virtualization are the only OS-level security paradigms added to Win 7 over Win XP. Without it, any background process running with administrative privileges can do what a logged-in administrator can do. This includes installing new software and doing essentially anything that a local TrustedInstaller user can do. Worse yet, if this ever happens when an admin user is logged in, the process would not even need to authenticate itself. It would just run it in the session of the logged-in admin user without the admin user ever knowing about it, with the admin user's full confidence that nothing can installed under his credentials (because he has UAC turned on and not allowing any installation to happen without first presenting a "may I, mother?" prompt). If they don't think the session security improvements are worth anything, why don't just start to openly support Win XP again? This is somewhat disturbing.
Any guest worker system is indistinguishable from indentured servitude.
Not quite physical access. He just needs an admin to log in. So there is an admin user session running.
Any guest worker system is indistinguishable from indentured servitude.
Developers need admin privileges. You can't debug services without them.
Any guest worker system is indistinguishable from indentured servitude.
Who in their right mind runs Admin and turns off UAC?
Precisely.
You deserve malware if your doing that.
The described bypass (at least from my reading of the Slashdot summary) allows to bypass the UAC prompt even if UAC is turned on.
Any guest worker system is indistinguishable from indentured servitude.
OK, 7-digit ID or not, are you really so new here you think that Slashdot summaries (or even articles) are an always-accurate representation of the world? Out here in the real world, where I've been working in information security longer than you've been on this site (and nearly as long as I have, actually), we understand the difference between "the attacker needs to physically or remotely accessing the machine" and "the attacker needs to have code executing on the machine". It's a very important difference. The fact that the summary implies direct access is required is stupid, but the fact that you (and, apparently, a significant number of other people) took that implication as fact says much more about you all than it does about the exploit.
Try reading the actual exploit writeup rather than dumbed-down ThreatPost article, and you'll see that no such claim is made. There's not a single step of the process that requires the level of access you'd need to approve a UAC prompt. Hell, even in the ThreatPost article, it doesn't say (or even imply) anything about physical access.
You can do this exploit if you get non-elevated arbitrary code execution (via remote compromise, or Trojan download, or anything else of that sort) in the account of a member of the Administrators group. You cannot click "Allow" via non-elevated code execution; UAC is very carefully designed to not allow non-elevated code to approve its prompts.
Please don't run your mouth when you don't know what you're talking about. This exploit, and the UAC default in Win7+, are both stupid enough already; you don't have to turn it into a three-way race. Think first, then post!
There's no place I could be, since I've found Serenity...
At home I block things at DNS level...thanks for the links!