5 ms·

Exactly how terrified should I be right now?

by billpg 8y ago

newsbinator 8y ago
7
luch 8y ago
Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.
- dmix 8y ago
  People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).
  - 3pt14159 8y ago
    (Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
    - dmix 8y ago
      > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.
      - 3pt14159 8y ago
        Yeah, sorry, a no-click / remote exploit is hard. I agree with you there. But a browser exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.
- RaleyField 8y ago
  Have they changed their policy on UAC not being considered security barrier on administrator accounts since W10? Windows was screwed for a long time[1], in practice not much better than running in SYSTEM all the time like in Windows 95 days. [1] http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ http://www.istartedsomething.com/20090611/uac-in-windows-7-s...
  - temac 8y ago
    I'm not sure even sure they will ever change it. It was designed for Vista using a security model that now corresponds to the "always ask" setting, and hastily changed to propose the two other settings for Windows 7 because users were thinking it asked too often. But the other settings do not even correspond to a sound security model, so there are hundreds or maybe thousands of bypass in Windows if using those, which include the setting by default. That's why MS simply declared that it is not a security boundary, because they had no sound model to make it work against. It's a "best effort" casual mitigation.
linker3000 8y ago
Well I've made my Plan B... https://github.com/linker3000/Z80-Board/blob/master/README.md https://github.com/linker3000/Z80-Board/blob/master/README.m... Wordstar and Supercalc (and Zork I, II and III) installed and working fine, so I'm good!
- ObsoleteNerd 8y ago
  I love this! I also love the idea of digital prepping (? Not sure if there's a real term for it). Even just jokingly preparing to have a set of tech work after some kind of apocalypse. UPS/solar driven home LAN with a server running copies of wiki, stack overflow, various other resources. Maybe a bunch of music/movies/games. Whatever would assist us if we lost the internet and power grids. I don't actually think that's likely to happen, but I absolutely do enjoy some mild prepping just for fun and because the effort is so low I might as well be prepared (we have a bugout bag, extensive first aid kit, all the basic tools and survival gear, etc). It's also just handy to have this stuff around and "own" it rather than always depend on others to be there for us.
  - dylan604 8y ago
    I've often wondered about obtaining my own copy of wikipedia (and other knowledge) to put on a portable device. It would be very useful when I jump in my time machine to travel back in time. I'm going to need to know how to build things so that I can become the "winner" of history. Of course, as history would show us if we learned, when you upset the apple cart, the establishment usually eliminates the threat. So, that's the last piece I haven't worked out yet. Oh, and the time traveling bit.
unit91 8y ago
Just enough to switch to Mac or Linux. :-)
lawnchair_larry 8y ago
Several of these are patched every month. It’s a non-event for the most part. If somebody was targeting you personally, it isn’t going to be a local privilege escalation bug that closes the gap for them.
mockingbirdy 8y ago
As a hacker I can assure you that I can just easily annoy you with UAC pop-ups until you click "Ok". So it doesn't really add much and you don't need SYSTEM to do great harm, anyways.
- mockingbirdy 8y ago
  To answer the downvotes: You can install Chrome extensions without the user noticing (built this in the past) which gives you access to basically everything without even resorting to DLL injections (I don't share this because it's dangerous and can't be fixed by the Chromium team). Reminder: It's possible to hijack 2FA and online banking with this method. I've read the source code of Zeus and SpyEye, I can do the same thing a) without AV detection and b) without DLL injections (which are very easy to spot). If you know the Win32 APIs, it's extremely easy to build malicious software that doesn't need escalated privileges. edit: I'm pretty sure I can implement it on Mac and Linux, too. I don't like the sentiment that those systems are more secure, it's just the difference in usage. edit2: I can recommend Sandboxie. Please use it to get a little bit more security.
  - exikyut 8y ago
    I'm genuinely curious how you'd go about doing what you describe. I'm vaguely aware that Chrome has a mechanism to silent-install extensions, IIRC when they're placed in the filesystem in a certain way, specified in the registry, or configured via GP. I don't remember which, but I think they install silently. Failing all that, you can probably just extract the extension into the Chrome profile folder and on next restart it'll pick it up. You saying it "gives you access to basically everything" makes me think you're doing one of the techniques above, which does bypass the permissions dialogs. And sure, "Access all data on all websites you visit" would grant you the ability to see everything in every webpage and do what you're describing. I honestly wouldn't mind knowing which Win32 APIs you're referring to. Perhaps you could drop a couple of them, so I get a ballpark idea of which direction you're going in with that. Finally, the reason I'm writing this comment, really, is that I'm _most_ curious how you'd implement "it" on macOS and Linux too. I 100% agree that both are just as vulnerable as Windows in their own ways but have less market share. I would be extremely interested to hear some of the ways you'd particularly go about attacking Linux, which I use everyday. SandboxIE doesn't run on macOS or Linux.
moetech 8y ago
Not at all since you aren't using Windows of course?
gabriel34 8y ago
From what I gather this is privilege escalation for a attacker that already has arbitrary code execution. It is serious but not "shut everything down immediately" serious. Malware or malicious apps you already have could be made more dangerous.
ajross 8y ago
It looks like a local privilege escalation per the comments elsewhere in the post. That's bad, but a low-ish risk to casual use of a personal device unless it's combined with some other way to get your system to execute an attacker's binary.
ak39 8y ago
https://www.zdnet.com/article/windows-zero-day-vulnerability-disclosed-through-twitter/ https://www.zdnet.com/article/windows-zero-day-vulnerability...

Exactly how terrified should I be right now?

by billpg 8y ago

Exactly how terrified should I be right now?

newsbinator 8y ago

luch 8y ago

Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.

dmix 8y ago
People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).
- 3pt14159 8y ago
  (Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
  - dmix 8y ago
    > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.
    - 3pt14159 8y ago
      Yeah, sorry, a no-click / remote exploit is hard. I agree with you there. But a browser exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.
RaleyField 8y ago
Have they changed their policy on UAC not being considered security barrier on administrator accounts since W10? Windows was screwed for a long time[1], in practice not much better than running in SYSTEM all the time like in Windows 95 days. [1] http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ http://www.istartedsomething.com/20090611/uac-in-windows-7-s...
- temac 8y ago
  I'm not sure even sure they will ever change it. It was designed for Vista using a security model that now corresponds to the "always ask" setting, and hastily changed to propose the two other settings for Windows 7 because users were thinking it asked too often. But the other settings do not even correspond to a sound security model, so there are hundreds or maybe thousands of bypass in Windows if using those, which include the setting by default. That's why MS simply declared that it is not a security boundary, because they had no sound model to make it work against. It's a "best effort" casual mitigation.

linker3000 8y ago

Well I've made my Plan B... https://github.com/linker3000/Z80-Board/blob/master/README.md https://github.com/linker3000/Z80-Board/blob/master/README.m... Wordstar and Supercalc (and Zork I, II and III) installed and working fine, so I'm good!

ObsoleteNerd 8y ago
I love this! I also love the idea of digital prepping (? Not sure if there's a real term for it). Even just jokingly preparing to have a set of tech work after some kind of apocalypse. UPS/solar driven home LAN with a server running copies of wiki, stack overflow, various other resources. Maybe a bunch of music/movies/games. Whatever would assist us if we lost the internet and power grids. I don't actually think that's likely to happen, but I absolutely do enjoy some mild prepping just for fun and because the effort is so low I might as well be prepared (we have a bugout bag, extensive first aid kit, all the basic tools and survival gear, etc). It's also just handy to have this stuff around and "own" it rather than always depend on others to be there for us.
- dylan604 8y ago
  I've often wondered about obtaining my own copy of wikipedia (and other knowledge) to put on a portable device. It would be very useful when I jump in my time machine to travel back in time. I'm going to need to know how to build things so that I can become the "winner" of history. Of course, as history would show us if we learned, when you upset the apple cart, the establishment usually eliminates the threat. So, that's the last piece I haven't worked out yet. Oh, and the time traveling bit.

unit91 8y ago

Just enough to switch to Mac or Linux. :-)

lawnchair_larry 8y ago

Several of these are patched every month. It’s a non-event for the most part. If somebody was targeting you personally, it isn’t going to be a local privilege escalation bug that closes the gap for them.

mockingbirdy 8y ago

As a hacker I can assure you that I can just easily annoy you with UAC pop-ups until you click "Ok". So it doesn't really add much and you don't need SYSTEM to do great harm, anyways.

mockingbirdy 8y ago
To answer the downvotes: You can install Chrome extensions without the user noticing (built this in the past) which gives you access to basically everything without even resorting to DLL injections (I don't share this because it's dangerous and can't be fixed by the Chromium team). Reminder: It's possible to hijack 2FA and online banking with this method. I've read the source code of Zeus and SpyEye, I can do the same thing a) without AV detection and b) without DLL injections (which are very easy to spot). If you know the Win32 APIs, it's extremely easy to build malicious software that doesn't need escalated privileges. edit: I'm pretty sure I can implement it on Mac and Linux, too. I don't like the sentiment that those systems are more secure, it's just the difference in usage. edit2: I can recommend Sandboxie. Please use it to get a little bit more security.
- exikyut 8y ago
  I'm genuinely curious how you'd go about doing what you describe. I'm vaguely aware that Chrome has a mechanism to silent-install extensions, IIRC when they're placed in the filesystem in a certain way, specified in the registry, or configured via GP. I don't remember which, but I think they install silently. Failing all that, you can probably just extract the extension into the Chrome profile folder and on next restart it'll pick it up. You saying it "gives you access to basically everything" makes me think you're doing one of the techniques above, which does bypass the permissions dialogs. And sure, "Access all data on all websites you visit" would grant you the ability to see everything in every webpage and do what you're describing. I honestly wouldn't mind knowing which Win32 APIs you're referring to. Perhaps you could drop a couple of them, so I get a ballpark idea of which direction you're going in with that. Finally, the reason I'm writing this comment, really, is that I'm _most_ curious how you'd implement "it" on macOS and Linux too. I 100% agree that both are just as vulnerable as Windows in their own ways but have less market share. I would be extremely interested to hear some of the ways you'd particularly go about attacking Linux, which I use everyday. SandboxIE doesn't run on macOS or Linux.

moetech 8y ago

Not at all since you aren't using Windows of course?

gabriel34 8y ago

From what I gather this is privilege escalation for a attacker that already has arbitrary code execution. It is serious but not "shut everything down immediately" serious. Malware or malicious apps you already have could be made more dangerous.

ajross 8y ago

It looks like a local privilege escalation per the comments elsewhere in the post. That's bad, but a low-ish risk to casual use of a personal device unless it's combined with some other way to get your system to execute an attacker's binary.

ak39 8y ago

https://www.zdnet.com/article/windows-zero-day-vulnerability-disclosed-through-twitter/ https://www.zdnet.com/article/windows-zero-day-vulnerability...