Comments on: Windows 7 auto-elevation mistake lets malware elevate freely, easily http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/ Not your usual Microsoft enthusiast blog. Fri, 20 Nov 2009 20:11:07 -0600 http://wordpress.org/?v=2.8.6 hourly 1 By: Pearl Tech » Blog Archive http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-4341 Pearl Tech » Blog Archive Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-4341 [...] in the week, independent researchers Rafael Rivera and Long Zheng described an exploit that could turn off the UAC prompt, which typically notifies [...] [...] in the week, independent researchers Rafael Rivera and Long Zheng described an exploit that could turn off the UAC prompt, which typically notifies [...]

 ]]> By: Why upgrade to Vista when Windows 7 will be here soon? | OS Attack http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-3734 Why upgrade to Vista when Windows 7 will be here soon? | OS Attack Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-3734 [...] change with UAC in Windows 7 that essentially makes it less secure than Windows Vista. Rafael of Within Windows then posted about applications that have been White Listed and are automatically elevated to the [...] [...] change with UAC in Windows 7 that essentially makes it less secure than Windows Vista. Rafael of Within Windows then posted about applications that have been White Listed and are automatically elevated to the [...]

 ]]> By: бaкинeц http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-3629 бaкинeц Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-3629 Глубокоуважаемые, а нельзя оставлять комментарии по теме, а не разную глупость типа Автор молодец и т.д. Глубокоуважаемые, а нельзя оставлять комментарии по теме, а не разную глупость типа Автор молодец и т.д.

]]> By: Tutto quello che c’è da sapere su Windows 7 « Guiodic Blog http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-3570 Tutto quello che c’è da sapere su Windows 7 « Guiodic Blog Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-3570 [...] In realtà non c’è bisogno che il programma venga direttamente infettato. E’ possibile realizzare semplicemente un malware che esegue uno di questi programmi e assume i privilegi di amministratore [...] [...] In realtà non c’è bisogno che il programma venga direttamente infettato. E’ possibile realizzare semplicemente un malware che esegue uno di questi programmi e assume i privilegi di amministratore [...]

 ]]> By: Software Source Update » Blog Archive » Windows 7 silently elevates malware access http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-3560 Software Source Update » Blog Archive » Windows 7 silently elevates malware access Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-3560 [...] Rafael Rivera Jr. has released proof-of-concept code that demonstrates how unauthorized third-party software can elevate its privileges and install [...] [...] Rafael Rivera Jr. has released proof-of-concept code that demonstrates how unauthorized third-party software can elevate its privileges and install [...]

 ]]> By: George http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-2583 George Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2583 This is one of the strangest proof of concept flaws I've ever seen. I totally understand how injecting a dll into a white listed app could exploit this. Would it not be better for the functions requiring admin privilledges to check if the invoker is white listed and if not, then prompt? That seems like an easier option. This is one of the strangest proof of concept flaws I’ve ever seen. I totally understand how injecting a dll into a white listed app could exploit this. Would it not be better for the functions requiring admin privilledges to check if the invoker is white listed and if not, then prompt? That seems like an easier option.

]]> By: List of Windows 7 (beta build 7000) auto-elevated binaries - 【windows7 Home】 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-2574 List of Windows 7 (beta build 7000) auto-elevated binaries - 【windows7 Home】 Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2574 [...] my last post regarding Windows 7’s new “auto-elevate” flag (and potential issues with such a system), I mentioned compiling a list of all the flagged [...] [...] my last post regarding Windows 7’s new “auto-elevate” flag (and potential issues with such a system), I mentioned compiling a list of all the flagged [...]

 ]]> By: blogger » Blog Archive » Microsoft changes Windows 7 UAC due to new exploit code http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-2527 blogger » Blog Archive » Microsoft changes Windows 7 UAC due to new exploit code Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2527 [...] will … automatically elevate the process to High Mandatory Level, executing your payload wearing an administrative hat," Rivera said in a post to his blog early this [...] [...] will … automatically elevate the process to High Mandatory Level, executing your payload wearing an administrative hat," Rivera said in a post to his blog early this [...]

 ]]> By: Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy | Window7s http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-2512 Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy | Window7s Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2512 [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...] [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...]

 ]]> By: Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy « Window7s http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-2/#comment-2509 Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy « Window7s Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2509 [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...] [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...]

 ]]> By: Mac OS X Dialog Box Spoofing—Believe Me, I’m System Preferences http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2474 Mac OS X Dialog Box Spoofing—Believe Me, I’m System Preferences Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2474 [...] While analyzing the recent OSX.Iservice.B threat I noticed some interesting API calls that were dealing directly with the Mac OS X authorization mechanism. There are plenty of interesting analyses and discussion about Windows UAC, both regarding Vista (Ollie’s post) or the recent Windows 7 UAC. [...] [...] While analyzing the recent OSX.Iservice.B threat I noticed some interesting API calls that were dealing directly with the Mac OS X authorization mechanism. There are plenty of interesting analyses and discussion about Windows UAC, both regarding Vista (Ollie’s post) or the recent Windows 7 UAC. [...]

 ]]> By: Microsoft responds to UAC criticism in Windows 7 and fixes design flaws | IT Knowledge Hub http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2470 Microsoft responds to UAC criticism in Windows 7 and fixes design flaws | IT Knowledge Hub Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2470 [...] in Windows 7 RC, you will always be prompted when the UAC level is changed to prevent any malicious scripts from silently changing your UAC level and taking over your computer. For everybody using Windows 7 [...] [...] in Windows 7 RC, you will always be prompted when the UAC level is changed to prevent any malicious scripts from silently changing your UAC level and taking over your computer. For everybody using Windows 7 [...]

 ]]> By: Microsoft responds to UAC criticism in Windows 7 and fixes design flaws | Windows 7 Center http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2461 Microsoft responds to UAC criticism in Windows 7 and fixes design flaws | Windows 7 Center Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2461 [...] in Windows 7 RC, you will always be prompted when the UAC level is changed to prevent any malicious scripts from silently changing your UAC level and taking over your computer. It’s a good sign that [...] [...] in Windows 7 RC, you will always be prompted when the UAC level is changed to prevent any malicious scripts from silently changing your UAC level and taking over your computer. It’s a good sign that [...]

 ]]> By: 4sysops - Windows 7 UAC vulnerabilities http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2456 4sysops - Windows 7 UAC vulnerabilities Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2456 [...] Rafael Rivera again wrote a proof-of-concept. He uses a proxy application, which he called Catapult.exe, that launches Cake.dll. With the default UAC setting, Windows will run Cake.dll with admin privileges without issuing a prompt. You can verify that if you set the UAC setting to “Always notify me”. If you start Catapult.exe with this configuration, you will get a UAC prompt. [...] [...] Rafael Rivera again wrote a proof-of-concept. He uses a proxy application, which he called Catapult.exe, that launches Cake.dll. With the default UAC setting, Windows will run Cake.dll with admin privileges without issuing a prompt. You can verify that if you set the UAC setting to “Always notify me”. If you start Catapult.exe with this configuration, you will get a UAC prompt. [...]

 ]]> By: Il web cambia la decisione di Microsoft sull’UAC di Windows 7 | Windows 7 Blog http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2455 Il web cambia la decisione di Microsoft sull’UAC di Windows 7 | Windows 7 Blog Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2455 [...] sul lavoro di Rafael Rivera Long Zheng ha dimostrato che la combinazione di elevation automatica di software [...] [...] sul lavoro di Rafael Rivera Long Zheng ha dimostrato che la combinazione di elevation automatica di software [...]

 ]]> By: Latest Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy | Gadget on Gatzet Info http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2442 Latest Second Windows 7 beta UAC security flaw: malware can silently self-elevate with default UAC policy | Gadget on Gatzet Info Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2442 [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...] [...] Without going into too much detail, as you already may know from the previous postings, Windows 7 has the ability automatically elevates Microsoft-signed applications and code which specifies “auto elevation” to mitigate the number of UAC prompts. Rafael Rivera has more details how this works. [...]

 ]]> By: Xtreem0 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2437 Xtreem0 Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2437 http://blogs.zdnet.com/microsoft/?p=1914 there is an update where apparently they say they have fixed it. Mined you we may not see the fix untill final releace http://blogs.zdnet.com/microsoft/?p=1914 there is an update where apparently they say they have fixed it. Mined you we may not see the fix untill final releace

]]> By: UAC in Windows 7 is like a screen door on a submarine | OS Attack http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2433 UAC in Windows 7 is like a screen door on a submarine | OS Attack Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2433 [...] posting their original findings Rafael Ravera has posted a follow up on his site showing how malware could use rundll32.exe or any other [...] [...] posting their original findings Rafael Ravera has posted a follow up on his site showing how malware could use rundll32.exe or any other [...]

 ]]> By: Boycott Novell » Turkey, France, United Stated Under Attack by Microsoft Windows Insecurities http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2431 Boycott Novell » Turkey, France, United Stated Under Attack by Microsoft Windows Insecurities Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2431 [...] status (beta) that wrongly indicates maturity, the operating system is not secure and it keeps looking worse as people study it more closely. As you probably know by now, Windows 7 introduces some new in-between modes for User Account [...] [...] status (beta) that wrongly indicates maturity, the operating system is not secure and it keeps looking worse as people study it more closely. As you probably know by now, Windows 7 introduces some new in-between modes for User Account [...]

 ]]> By: » Microsoft: UAC security setting not changing (for now) | All about Microsoft | ZDNet.com http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2428 » Microsoft: UAC security setting not changing (for now) | All about Microsoft | ZDNet.com Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2428 [...] the entire UAC security-setting controversy, I’ll just point to a few posts about it from Within Windows, Istartedsomething, and yours truly. [...] [...] the entire UAC security-setting controversy, I’ll just point to a few posts about it from Within Windows, Istartedsomething, and yours truly. [...]

 ]]> By: Nicky http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2427 Nicky Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2427 Although I'm currently at work and havent yet tried hack created by the author, I will try it when I get home and post my results. Although I’m currently at work and havent yet tried hack created by the author, I will try it when I get home and post my results.

]]> By: Nicky http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2426 Nicky Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2426 If explorer will allow anyone to take advantage of elevated privilages, then what is the solution, to what I see as the most ridiculous security flaw ever? I was under the impression that Windows 7 was supposed to be supiriour to Vista in every sense. I have been running build 7000 for about a week and I'm very happy with it so far but if I have to get annoying confirm boxes every 30 seconds just to have a secure OS then I'll probably start looking elsewhere for a new OS. If explorer will allow anyone to take advantage of elevated privilages, then what is the solution, to what I see as the most ridiculous security flaw ever? I was under the impression that Windows 7 was supposed to be supiriour to Vista in every sense. I have been running build 7000 for about a week and I’m very happy with it so far but if I have to get annoying confirm boxes every 30 seconds just to have a secure OS then I’ll probably start looking elsewhere for a new OS.

]]> By: asf http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2423 asf Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2423 @Dan: I was not sure if cmd.exe could be auto elevated. The point still stands, if explorer gives you full control, you can replace a dll that implements some shell extension with your own evil dll @Dan: I was not sure if cmd.exe could be auto elevated. The point still stands, if explorer gives you full control, you can replace a dll that implements some shell extension with your own evil dll

]]> By: Win 7 fan http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2421 Win 7 fan Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2421 It does not work 4 me. I am running win 7 built 7000 It does not work 4 me. I am running win 7 built 7000

]]> By: Leo Davidson http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-lets-malware-elevate-freely-easily/comment-page-1/#comment-2417 Leo Davidson Wed, 31 Dec 1969 18:00:00 +0000 http://www.withinwindows.com/2009/02/04/windows-7-auto-elevation-mistake-let-malware-elevate-freely-easily/#comment-2417 @Dan: I know Exploder doesn't run elevated. It doesn't have to. It, or anything running inside of it, can *silently* elevate other code. That's the whole problem. (And it's not just limited to Explorer.exe; I'm just using that as a well-known example other than RunDll32.exe.) In the past elevated processes could create other elevated processes. That isn't an issue because there's nothing you can't do in the original process that you can do in the ones it can spawn. If you've taken control of an elevated process you don't need to spawn another one; you can do whatever you want in the process you already have. Now, by default in Win7 beta, there are non-elevated processes like Explorer.exe which can create elevated processes without prompting. And since Explorer.exe (etc.) are non-elevated, *all* *other* non-elevated processes can take control of them and in turn elevate anything they want without prompting. In other words, a non-elevated process which is not whitelisted for silent elevation can elevate things silently with very little effort. That's the problem! It's getting frustrating explaining this again and again. :( @Dan: I know Exploder doesn’t run elevated. It doesn’t have to. It, or anything running inside of it, can *silently* elevate other code.

That’s the whole problem. (And it’s not just limited to Explorer.exe; I’m just using that as a well-known example other than RunDll32.exe.)

In the past elevated processes could create other elevated processes. That isn’t an issue because there’s nothing you can’t do in the original process that you can do in the ones it can spawn. If you’ve taken control of an elevated process you don’t need to spawn another one; you can do whatever you want in the process you already have.

Now, by default in Win7 beta, there are non-elevated processes like Explorer.exe which can create elevated processes without prompting. And since Explorer.exe (etc.) are non-elevated, *all* *other* non-elevated processes can take control of them and in turn elevate anything they want without prompting.

In other words, a non-elevated process which is not whitelisted for silent elevation can elevate things silently with very little effort. That’s the problem!

It’s getting frustrating explaining this again and again. :(

]]>