4 ms·

Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to

by luch 8y ago

Not terribly terrified. At best it seem to be a Medium IL to SYSTEM. In other words a slightly better UAC bypass than most, but I don't think you can use it to escape from a browser sandbox for example.

dmix 8y ago
People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).
- 3pt14159 8y ago
  (Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
  - dmix 8y ago
    > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.
    - 3pt14159 8y ago
      Yeah, sorry, a no-click / remote exploit is hard. I agree with you there. But a browser exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.
RaleyField 8y ago
Have they changed their policy on UAC not being considered security barrier on administrator accounts since W10? Windows was screwed for a long time[1], in practice not much better than running in SYSTEM all the time like in Windows 95 days. [1] http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ http://www.istartedsomething.com/20090611/uac-in-windows-7-s...
- temac 8y ago
  I'm not sure even sure they will ever change it. It was designed for Vista using a security model that now corresponds to the "always ask" setting, and hastily changed to propose the two other settings for Windows 7 because users were thinking it asked too often. But the other settings do not even correspond to a sound security model, so there are hundreds or maybe thousands of bypass in Windows if using those, which include the setting by default. That's why MS simply declared that it is not a security boundary, because they had no sound model to make it work against. It's a "best effort" casual mitigation.

by luch 8y ago

dmix 8y ago

People always seem to overlook this distinction... escalating admin privileges is typically one of the easier things for a hacker to do. Getting in is the harder part (ie, remote/browser exploits, etc).

3pt14159 8y ago
(Hey dmix; hangs soon?) I'm not really sure if that is true. Adobe exploits are pretty cheap and unless your target is in software you can usually get a click on a link one way or another. Really, to me, the hard part is getting in without needing to have the user consciously do anything since then you're in and nobody could even have noticed you doing something.
- dmix 8y ago
  > Really, to me, the hard part is getting in without needing to have the user consciously do anything That's why I said remote/browser, everything else is noisy and therefore the 'easy' route. Usually this is sufficient for low tech nation states because they attack organizations not individuals, so all you need is a weak human link where noisey isn't a big deal. Then moving horizontally across the organization. But more importantly OS are terribly insecure and privesc bugs are a dime a dozen. You don't need zero days to achieve that the vast majority of the time.
  - 3pt14159 8y ago
    Yeah, sorry, a no-click / remote exploit is hard. I agree with you there. But a browser exploit isn't. They're a dime a dozen. Also, I'm surprised that email is still a primary vector that's used to get people to click on links with their work computer. It seems like such a monitored method compared to, say, a LinkedIn contact.

RaleyField 8y ago

Have they changed their policy on UAC not being considered security barrier on administrator accounts since W10? Windows was screwed for a long time[1], in practice not much better than running in SYSTEM all the time like in Windows 95 days. [1] http://www.istartedsomething.com/20090611/uac-in-windows-7-still-broken-microsoft-wont-fix-code-injection-vulnerability/ http://www.istartedsomething.com/20090611/uac-in-windows-7-s...

temac 8y ago
I'm not sure even sure they will ever change it. It was designed for Vista using a security model that now corresponds to the "always ask" setting, and hastily changed to propose the two other settings for Windows 7 because users were thinking it asked too often. But the other settings do not even correspond to a sound security model, so there are hundreds or maybe thousands of bypass in Windows if using those, which include the setting by default. That's why MS simply declared that it is not a security boundary, because they had no sound model to make it work against. It's a "best effort" casual mitigation.