6 ms·

It's completely unrelated, but it reminds me of the Metasploit UAC bypass for Windows, called "ask". Metasploit just pops up a UAC prompt asking for escalation

by hug 5y ago

It's completely unrelated, but it reminds me of the Metasploit UAC bypass for Windows, called "ask". Metasploit just pops up a UAC prompt asking for escalation. Yes or no. Over and over and over again. On any machine logged into by a local administrator user, if they're the standard kind of careless user, they'll just click yes without thinking and they're owned. If they're cautious, and on a box where UAC presents as a modal dialog, as per its default config, this essentially locks the user out of the OS until they click "yes"... and they're owned. On an assessment we did at a local 200-seat business where they ran with admin rights on their local boxes, we got about a 90% escalation rate. The other 10% of people got up from their desks and went to ask the IT guy, which we considered a "pass" in that scenario. Interesting stuff.

ma2rten 5y ago
Did people who clicked "yes" eventually report it to IT later?
WrtCdEvrydy 5y ago
I wonder if "annoying the user into submission" is "social engineering". We had a similar issue with a library that wouldn't install unless root so one of the developers just put his username/password into the box in a plaintext file so the script could basically assume it from the command line when needed... told noone about it.
- hug 5y ago
  Yep. It's worse when working with vendors, and even worse when working with vendors in a Windows-centric environment. "Our application needs to run as domain admin". No, mate, it absolutely does not. "Well it definitely needs local admin". No, mate, it doesn't even need that. What it usually needs is write-access to a single folder or regkey somewhere that has default ACLs on it that only allow local admins, but trying to have that conversation is a waste of time. Of course as soon as you say something like that, all support bets are off. Depending on the business you're working for you either suck it up so you have a 'support agreement' in place, or you do it properly and never talk to the vendor again. (Or option #3, you rebuild the app in its default "holy shit this is how my business gets owned" mode, place a support call, and have them fix that instance while you watch so you can replicate their efforts elsewhere.) Most of the same set of vendors get their panties in a twist when you tell them their database is on RDS, too, but that's a whole different argument to have with these people.
  - jasonjayr 5y ago
    I've had to support an app that: 1) only ran in MSIE 2) required the domain policy to permit VBScript 3) required permission to launch + invoke local COM/applications 4) served over http:// http:// All just so they could direct MSWord to directly print the server-side generated Sales Order template. I audibly gasped and asked if they knew this put our systems at extreme risk, and the tech talking me through it basically shrugged "it's how it works" Thankfully that webapp 'upgraded' years ago so that's no longer how it's done, but when it's the only way to get orders into your business from one of your top 10 customers, you just setup a workstation to do it :(
  - nicoburns 5y ago
    What is so great about this software that people put up with this kind of crap?
    - _wldu 5y ago
      Probably non-technical managers making technical decisions. They run off or fire anyone who has a clue (seen as obstructionists). After that, it's to hell in a hand basket.
  - user5994461 5y ago
    I honestly wonder who can use these applications these days? Large companies have stopped giving administrator access years ago. The vendor could corrupt their way into some middle manager all they want, they have zero power over procurement and IT, users won't get administrator access to use the app. If the app is really unusable, which it is, that must be preventing a whole lot of sales.
    - hhh 5y ago
      Microsoft provides toolkits to help with this. I have spent easily 100+ hours churning through a catalogue of applications that 'need local admin' and have only found one case where it was true, and it was due to a bug that the latest software version fixed. It is almost always a false truth due to cost I feel. I primarily analyzed applications that were for PLCS and other industrial equipment. You can find more information about this here: https://docs.microsoft.com/en-us/windows/deployment/planning/compatibility-administrator-users-guide https://docs.microsoft.com/en-us/windows/deployment/planning... I run a VM that stays up to date with the latest Windows version that I install the toolkit on for testing. (side tangent, the user of this application insisted they had the latest version, and with it being behind some login that required some form related to ITAR or something to register, we just had to trust him until I had him download it 'just in case.')
- deleted 5y ago
  [deleted]
- ithinkso 5y ago
  It's the same malware behaviour as 'Yes / Remind me later'
- npteljes 5y ago
  It's a technique to use the human component to gain access, so it's absolutely social engineering.
nonameiguess 5y ago
The example from this blog is much worse than that. At least "ask" relies upon the user being an administrator and granting access. This application ran as root already without needing escalation and allowed anyone to run arbitrary commands as pre and post hooks. I can't even conceive of what a worse security hole would look like. This is unauthenticated root shell to anyone on the network. Maybe Intel Management Engine is worse since it grants privilege to run instructions and access hardware even the OS can't get to?
- anyfoo 5y ago
  Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configured" Linux servers a number of years ago, it was likely equivalent to total access. Including control of the kernel through things like /dev/mem, /dev/kmem, and /dev/ports, which at least were common and accessible to root a while ago. With newer stuff in certain configurations, something that gives you remote execution in the kernel or even lower (your Intel ME Engine example seems like a good one) is a much worse security hole, yeah (but then this one could still be a stepping stone to the worse bug).
  - T3OU-736 5y ago
    TCSEC [1] levels high enough specified that root wasn't omnipotent, nor could do things unilaterally, and never without logging. B2 and higher, if memory serves. SGI's IRIX could be a part of a B2-level installation (because criteria was applicable to more than just the OS). So much wheel reinvention sometimes... [1] https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...
    - anyfoo 5y ago
      Yeah, I tried to qualify my statement a lot ("normally configured", "Linux server", "number of years ago"...). But I think the subjective viewpoint I gave is probably familiar to a lot of people that used to deal with commodity Linux servers. I share the sentiment with the wheel reinvention, though. This will continue happening...
c3534l 5y ago
I have definitely done some stupid stuff because I was typing when a popup came up which caused me to hit enter on a dialogue before I could even read it.
deleted 5y ago
[deleted]
SeriousM 5y ago
That's halirious and funny at the same time! I remember that I pressed yes too often as I was unexperienced long time ago. It's interesting to see that microsoft ships a tool to secure and trap the user at the same time :)
MesSWK 5y ago
Reminds me of what some malware does. One malware "Betabot" would pretend to be a Microsoft program and ask users to click yes [0]. It is claimed it would work 80% of the time which isn't surprising if users have the ability to escalate the privilege. Not the most subtle approach to escalate privilege of course. [0] https://www.ic3.gov/Media/PDF/Y2013/PSA130918.pdf https://www.ic3.gov/Media/PDF/Y2013/PSA130918.pdf
q-rews 5y ago
That's cookie banners in action. When "yes" is a click a way and "no" requires exploring a bad UI and possibly waiting whole seconds and a page refresh, you will expect people to just click yes and get it over with.
- Thiez 5y ago
  Which is why it is illegal, of course. Sadly that bit of the law is rarely enforced.
smcl 5y ago
Funny, with the rise of MFA various Authenticator apps are installed on our phones. Some applications (I'm looking at you, Outlook) will randomly shit themselves and request I hit a button in the app a few times per day, otherwise I'll not receive emails or meeting requests. I can easily see this completely defeating the purpose of MFA by numbing people into automatically accepting these notifications.
- corty 5y ago
  I think the problem isn't limited to Microsoft Outlook but to anything bound to ActiveDirectory: Randomly, sometimes multiple times per day, sometimes not for a week, Teams, WebEx and Office365 will re-reqest credentials. In some cases they continue to work even if you ignore the prompts, sometimes they don't...
  - noneeeed 5y ago
    Ok, good to hear it's not just me. We've recently been aquired and the new company uses Outlook. I can't use the desktop app as it constantly asks me to go through the full authentication process. I have to use the web interface which is just fine for me as I mostly use macOS native apps for mail and calendar. I only use outlook to report phishing emails.
  - wcarss 5y ago
    This happens with google too (though thankfully much less often): when it expires your credentials, it could be for mail, calendar, drive, meet, etc., it all redirects to just a generic "log into google" form, with no mention even of what you're logging into, to allow you to remember, "ah yeah, I had a docs tab open". I think password managers matching domains with credentials might help a little here, but it normalizes finding random tabs with "google" asking for creds down below the point of noise. It often happens right as I log in in the morning to go into my first meetings, and I'm rushed. Somewhere, someone has likely exploited this by now.
    - newbamboo 5y ago
      That one has an easy solution: dump google.
passivate 5y ago
UAC is not a security boundary, its simply a UX feature. The only reason that so called 'exploit' works is because the logged in user already has admin privileges. I would not categorize it as an exploit, but yes interesting. Its similar to popping up a fake authentication screen and asking the user to type their admin password.

by hug 5y ago

ma2rten 5y ago

Did people who clicked "yes" eventually report it to IT later?

WrtCdEvrydy 5y ago

I wonder if "annoying the user into submission" is "social engineering". We had a similar issue with a library that wouldn't install unless root so one of the developers just put his username/password into the box in a plaintext file so the script could basically assume it from the command line when needed... told noone about it.

hug 5y ago
Yep. It's worse when working with vendors, and even worse when working with vendors in a Windows-centric environment. "Our application needs to run as domain admin". No, mate, it absolutely does not. "Well it definitely needs local admin". No, mate, it doesn't even need that. What it usually needs is write-access to a single folder or regkey somewhere that has default ACLs on it that only allow local admins, but trying to have that conversation is a waste of time. Of course as soon as you say something like that, all support bets are off. Depending on the business you're working for you either suck it up so you have a 'support agreement' in place, or you do it properly and never talk to the vendor again. (Or option #3, you rebuild the app in its default "holy shit this is how my business gets owned" mode, place a support call, and have them fix that instance while you watch so you can replicate their efforts elsewhere.) Most of the same set of vendors get their panties in a twist when you tell them their database is on RDS, too, but that's a whole different argument to have with these people.
- jasonjayr 5y ago
  I've had to support an app that: 1) only ran in MSIE 2) required the domain policy to permit VBScript 3) required permission to launch + invoke local COM/applications 4) served over http:// http:// All just so they could direct MSWord to directly print the server-side generated Sales Order template. I audibly gasped and asked if they knew this put our systems at extreme risk, and the tech talking me through it basically shrugged "it's how it works" Thankfully that webapp 'upgraded' years ago so that's no longer how it's done, but when it's the only way to get orders into your business from one of your top 10 customers, you just setup a workstation to do it :(
- nicoburns 5y ago
  What is so great about this software that people put up with this kind of crap?
  - _wldu 5y ago
    Probably non-technical managers making technical decisions. They run off or fire anyone who has a clue (seen as obstructionists). After that, it's to hell in a hand basket.
- user5994461 5y ago
  I honestly wonder who can use these applications these days? Large companies have stopped giving administrator access years ago. The vendor could corrupt their way into some middle manager all they want, they have zero power over procurement and IT, users won't get administrator access to use the app. If the app is really unusable, which it is, that must be preventing a whole lot of sales.
  - hhh 5y ago
    Microsoft provides toolkits to help with this. I have spent easily 100+ hours churning through a catalogue of applications that 'need local admin' and have only found one case where it was true, and it was due to a bug that the latest software version fixed. It is almost always a false truth due to cost I feel. I primarily analyzed applications that were for PLCS and other industrial equipment. You can find more information about this here: https://docs.microsoft.com/en-us/windows/deployment/planning/compatibility-administrator-users-guide https://docs.microsoft.com/en-us/windows/deployment/planning... I run a VM that stays up to date with the latest Windows version that I install the toolkit on for testing. (side tangent, the user of this application insisted they had the latest version, and with it being behind some login that required some form related to ITAR or something to register, we just had to trust him until I had him download it 'just in case.')
deleted 5y ago
[deleted]
ithinkso 5y ago
It's the same malware behaviour as 'Yes / Remind me later'
npteljes 5y ago
It's a technique to use the human component to gain access, so it's absolutely social engineering.

nonameiguess 5y ago

The example from this blog is much worse than that. At least "ask" relies upon the user being an administrator and granting access. This application ran as root already without needing escalation and allowed anyone to run arbitrary commands as pre and post hooks. I can't even conceive of what a worse security hole would look like. This is unauthenticated root shell to anyone on the network. Maybe Intel Management Engine is worse since it grants privilege to run instructions and access hardware even the OS can't get to?

anyfoo 5y ago
Nowadays, depending on the OS and it's configuration, root is not necessarily the end to end all things, but if the servers in question were "normally configured" Linux servers a number of years ago, it was likely equivalent to total access. Including control of the kernel through things like /dev/mem, /dev/kmem, and /dev/ports, which at least were common and accessible to root a while ago. With newer stuff in certain configurations, something that gives you remote execution in the kernel or even lower (your Intel ME Engine example seems like a good one) is a much worse security hole, yeah (but then this one could still be a stepping stone to the worse bug).
- T3OU-736 5y ago
  TCSEC [1] levels high enough specified that root wasn't omnipotent, nor could do things unilaterally, and never without logging. B2 and higher, if memory serves. SGI's IRIX could be a part of a B2-level installation (because criteria was applicable to more than just the OS). So much wheel reinvention sometimes... [1] https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria https://en.m.wikipedia.org/wiki/Trusted_Computer_System_Eval...
  - anyfoo 5y ago
    Yeah, I tried to qualify my statement a lot ("normally configured", "Linux server", "number of years ago"...). But I think the subjective viewpoint I gave is probably familiar to a lot of people that used to deal with commodity Linux servers. I share the sentiment with the wheel reinvention, though. This will continue happening...

c3534l 5y ago

I have definitely done some stupid stuff because I was typing when a popup came up which caused me to hit enter on a dialogue before I could even read it.

deleted 5y ago

[deleted]

SeriousM 5y ago

That's halirious and funny at the same time! I remember that I pressed yes too often as I was unexperienced long time ago. It's interesting to see that microsoft ships a tool to secure and trap the user at the same time :)

MesSWK 5y ago

Reminds me of what some malware does. One malware "Betabot" would pretend to be a Microsoft program and ask users to click yes [0]. It is claimed it would work 80% of the time which isn't surprising if users have the ability to escalate the privilege. Not the most subtle approach to escalate privilege of course. [0] https://www.ic3.gov/Media/PDF/Y2013/PSA130918.pdf https://www.ic3.gov/Media/PDF/Y2013/PSA130918.pdf

q-rews 5y ago

That's cookie banners in action. When "yes" is a click a way and "no" requires exploring a bad UI and possibly waiting whole seconds and a page refresh, you will expect people to just click yes and get it over with.

Thiez 5y ago
Which is why it is illegal, of course. Sadly that bit of the law is rarely enforced.

smcl 5y ago

Funny, with the rise of MFA various Authenticator apps are installed on our phones. Some applications (I'm looking at you, Outlook) will randomly shit themselves and request I hit a button in the app a few times per day, otherwise I'll not receive emails or meeting requests. I can easily see this completely defeating the purpose of MFA by numbing people into automatically accepting these notifications.

corty 5y ago
I think the problem isn't limited to Microsoft Outlook but to anything bound to ActiveDirectory: Randomly, sometimes multiple times per day, sometimes not for a week, Teams, WebEx and Office365 will re-reqest credentials. In some cases they continue to work even if you ignore the prompts, sometimes they don't...
- noneeeed 5y ago
  Ok, good to hear it's not just me. We've recently been aquired and the new company uses Outlook. I can't use the desktop app as it constantly asks me to go through the full authentication process. I have to use the web interface which is just fine for me as I mostly use macOS native apps for mail and calendar. I only use outlook to report phishing emails.
- wcarss 5y ago
  This happens with google too (though thankfully much less often): when it expires your credentials, it could be for mail, calendar, drive, meet, etc., it all redirects to just a generic "log into google" form, with no mention even of what you're logging into, to allow you to remember, "ah yeah, I had a docs tab open". I think password managers matching domains with credentials might help a little here, but it normalizes finding random tabs with "google" asking for creds down below the point of noise. It often happens right as I log in in the morning to go into my first meetings, and I'm rushed. Somewhere, someone has likely exploited this by now.
  - newbamboo 5y ago
    That one has an easy solution: dump google.

passivate 5y ago

UAC is not a security boundary, its simply a UX feature. The only reason that so called 'exploit' works is because the logged in user already has admin privileges. I would not categorize it as an exploit, but yes interesting. Its similar to popping up a fake authentication screen and asking the user to type their admin password.