Slashdot Mirror
Windows 10 UAC Bypass Uses Backup and Restore Utility (bleepingcomputer.com)
An anonymous reader writes: "A new User Access Control (UAC) bypass technique relies on altering Windows registry app paths and using the Backup and Restore utility to load malicious code without any security warning," reports BleepingComputer. The technique works when an attacker launches the Backup and Restore utility, which loads its control panel settings page. Because the utility doesn't known where this settings page is located, it queries the Windows Registry. The problem is that low-privileged users can modify Windows Registry values and point to malware. Because the Backup and Restore utility is a trusted application, UAC prompts are suppressed. This technique only works in Windows 10 (not earlier OS versions) and was tested with Windows 10 build 15031. A proof-of-concept script is available on GitHub. The same researcher had previously found two other UAC bypass techniques, one that abuses the Windows Event Viewer, and one that relies on the Windows 10 Disk Cleanup utility
Saint Patrick's Day, or the Feast of Saint Patrick (Irish: Lá Fhéile Pádraig, "the Day of the Festival of Patrick"), is a cultural and religious celebration held on 17 March, the traditional death date of Saint Patrick (c. AD 385–461), the foremost patron saint of Ireland. Saint Patrick's Day was made an official Christian feast day in the early 17th century and is observed by the Catholic Church, the Anglican Communion (especially the Church of Ireland),[4] the Eastern Orthodox Church, and the Lutheran Church. The day commemorates Saint Patrick and the arrival of Christianity in Ireland,[3] and celebrates the heritage and culture of the Irish in general.[5] Celebrations generally involve public parades and festivals, cèilidhs, and the wearing of green attire or shamrocks.[6] Some Catholic Christians also attend church services[5][7] and historically in Ireland the Lenten restrictions on eating and drinking alcohol were lifted for the day, which encouraged and propagated the holiday's tradition of alcohol consumption.[5][6][8][9] Saint Patrick's Day is a public holiday in the Republic of Ireland,[10] Northern Ireland,[11] the Canadian province of Newfoundland and Labrador (for provincial government employees), and the British Overseas Territory of Montserrat. It is also widely celebrated by the Irish diaspora around the world, especially in Great Britain, Canada, the United States, Argentina, Australia, and New Zealand. Saint Patrick's Day is celebrated in more countries than any other national festival.[12] Modern celebrations have been greatly influenced by those of the Irish diaspora, particularly those that developed in North America. In recent years, there has been criticism of Saint Patrick's Day celebrations for having become too commercialised and for fostering negative stereotypes of the Irish. Contents 1 Saint Patrick 2 Celebration and traditions 2.1 Wearing of the green 3 Celebrations by region 3.1 Ireland 3.2 Elsewhere in Europe 3.2.1 Great Britain 3.2.2 Russia 3.2.3 Scotland 3.2.4 Switzerland 3.3 Asia 3.3.1 Japan 3.3.2 Korea 3.3.3 Malaysia 3.4 Caribbean 3.4.1 Montserrat 3.5 International Space Station 3.6 North America 3.6.1 Canada 3.6.2 United States 3.7 South America 3.7.1 Argentina 4 Criticism 5 Sports events 6 See also 7 References 8 External links Saint Patrick Main article: Saint Patrick Patrick was a 5th-century Romano-British Christian missionary and bishop in Ireland. Much of what is known about Saint Patrick comes from the Declaration, which was allegedly written by Patrick himself. It is believed that he was born in Roman Britain in the fourth century, into a wealthy Romano-British family. His father was a deacon and his grandfather was a priest in the Christian church. According to the Declaration, at the age of sixteen, he was kidnapped by Irish raiders and taken as a slave to Gaelic Ireland.[13] It says that he spent six years there working as a shepherd and that during this time he "found God". The Declaration says that God told Patrick to flee to the coast, where a ship would be waiting to take him home. After making his way home, Patrick went on to become a priest. According to tradition, Patrick returned to Ireland to convert the pagan Irish to Christianity. The Declaration says that he spent many years evangelising in the northern half of Ireland and converted "thousands". Patrick's efforts against the druids were eventually turned into an allegory in which he drove "snakes" out of Ireland (Ireland never had any snakes). Tradition holds that he died on 17 March and was buried at Downpatrick. Over the following centuries, many legends grew up around Patrick and he became Ireland's foremost saint. Celebration and traditions According to legend, Saint Patrick used the three-leaved shamrock to explain the Holy Trinity to Irish pagans. T
Problem 1: Why would you use the registry to find an app path? What happened to using the system environment path which is already secured? Registry. Pshhh!
Problem 2: Auto Elevation. Microsoft introduces UAC. People get annoyed with it. Microsoft introduces Auto Elevation. Guess what, still annoying and now possible security hole.
I am fine if Windows asks me to enter a user and password to elevate. It works on my *cough* Linux desktop. Annoying? Yes. Secure? More so. But really, how often does one use admin functions?
= Abomination
The concept is interesting, but the execution is shiite. What, were they thinking?
has a long history of exploits even thought this one is only windows 10.
Come on, just looking at how hard they're shoving Win10 down everyone's throat, you know the NSA placed a ton of backdoors in Win10 disguised as bugs, enough to last a decade of "bug" discoveries.
Come on guys. It even says it right in the script:
if($ConsentPrompt -Eq 2 -And $SecureDesktopPrompt -Eq 1){
"UAC is set to 'Always Notify'. This module does not bypass this setting."
exit
Always Notify is the default setting.
...to disable all adblocking, just to see if theres a nadella-parrot "upgrade-to-10-upgrade-to-10"-ad on adticlies like this...
> I just made a non-privileged user account to see if I could modify the registry.
Meaning the account you normally use is a member of the Administrators group? According to the article, that's the type of account this targets, a member of the admin group.
sooo in other words another non story, UAC is not a guarantee to start with and when you are using an admin account it is little more than a hurdle.
Meaning the account you normally use is a member of the Administrators group?
Meaning the account I use is a "local power user" account. What? You didn't know you could still make those with a little bit of effort?
Om, nomnomnom...
That's because everyone decided to just not use xauth as is and tunnel X via ssh instead to avoid that remote vunerability. If it's not listening (which has been the default everywhere with X since about 1998 when Hummingbird finally fixed their MS Windows version of X) it's not vunerable. You have to work hard and edit odd config files to make it vunerable.
Windows 10 IS SHIT
Face it.
Windows is dead.
Not. Even. Once!
"You walked away from your machine for ten minutes, ha ha!"
"Windows 10 is updating whether you (the fuck) like it or not."
"This should take a minute (or 20) (or 30)"
"Do not ask why replacing a few signed components takes so long"
"Do not turn off your computer"
Glad I also have an old ATM running XP SP3 to use.
<blink>down the rabbit hole</blink>
If you want a Blue UAC prompt that indicates the program being run is signed by Microsoft and everything, you can write a program that invokes privileged parts of Windows.
For example, you can call the DISM package manager of Windows to install or remove components of Windows. And when you call it, you get the Blue "Everything is okay, it's all signed by Microsoft" UAC prompt as opposed to the Yellow "This isn't signed" UAC prompt. But using DISM irresponsibly can break a Windows installation.
. . . with regular security rollups. The introduction of Windows 10 introduced this new vulnerability.
Why? OSs were long ago perfected, for good or ill. There have been zero positive changes in new versions, other than rearranging the interfaces like moving chairs on the Titanic.
...This technique only works in Windows 10 (not earlier OS versions)...
Tell me it's not true, Microsoft!
It's easy having a separate admin account, which is rarely used.