Slashdot Mirror
Researcher Finds Simple Way of Backdooring Windows PCs and Nobody Notices for Ten Months (zdnet.com)
A security researcher from Colombia has found a way of gaining admin rights and boot persistence on Windows PCs that's simple to execute and hard to stop -- all the features that hackers and malware authors are looking for from an exploitation technique. From a report: What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns. Discovered by Sebastian Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID). The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts.
Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.
Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.
Can we have a link to material that might verify this claim?
But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password
If that's the case, I don't think the hacker needs to worry much about mucking around in the Registry to get administrative access.
If you post as Anonymous Coward, don't expect a reply.
"Oh yes, I thought of something," panted Ford.
Arthur looked up expectantly.
"But unfortunately," continued Ford, "it rather involved being on the other side of this airtight hatchway."
+1
nothing to see here - move along
Why bother granting administrative privileges when the device is physically accessed and any nefarious payloads can already be executed?! Just because a "slow-burn" strategy might be employed to take down a target network, that doesn't make this "vulnerability" a big deal. Instead the underlying issue is that when poor security practices are employed and registry access is readily offered... anything bad can happen, from granting elevated privileges or printing out codes for the nuclear fusion reactors.
Sure, it's a bit of an issue, but the only sensible fix is to store all RID-encoded permissions into an alternate location (cloud) which is not otherwise accessible on the local machine. But then all Windows machines would *require* internet access... or all log-ins would be susceptible to man-in-the-middle attacks during authn/authz checks against the cloud (or proximate central auth directory).
Come to think of it, the solution already exists: domain-join all workstations against a locally-deployed AD. Yay, problem solved.
This is the equivalent of a Linux newbie who fancies himself a "security researcher" discovering that the root user can add any user to any group and thinking he thought of a new "trick" and found a "vulnerability."
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
It could be thought of as a very slight issue.
Someone could combine a privilege escalation attack with this to persist a user that is an admin, without visibility. E.g. they would essentially be in the "Administrators" group without showing up in that group.
Yes, this is incredibly sensationalized for what it is. There are far bigger risks if some rogue process or actor has administrative privileges to begin with. Once you're owned, you are already owned.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
This is dumb. The exploit requires you break into the system by other means. And if you're successful with that, why the hell would you need this after you've already compromised the system?
I guess that is news.
But it doesn't say a low privilege account can run this exploit.
Sounds more like "admin level account can give admin access to non-admin account" issue. Which you can do anyway...
Now if the guest account had permission to alter those registry keys, that would be more serious. No where do they say that's the case.
They're doing their job fantastically.
That being "post click-bait headlines to increase ad revenue"
"You're too stupid to be allowed to run windows, so here's something that's harder to use and easier to fuck up"
Good one.
If I am reading the summary correctly, what they are saying is that if you have admin rights, you can grant other users admin rights.
The truth is that all men having power ought to be mistrusted. James Madison
Not if you take the hard drive out, attach it to another computer, and edit the file, you don't.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
he went on to show that `sudo passwd root` was a privilege elevation exploit.
at least its fixed now.....10 years later. I found a couple 0days in my life, i took the fame and money though