4 ms·

Patent 7,945,947 lol, they patented a privilege escalation rootkit

sarciszewski 12y ago
Technology Transfer Program S ecurity | Page 63 P ROVIDING A C OMPUTER U SER WITH H IGH -L EVEL P RIVILEDGES P ATENT N O .: 7,945,947 This invention monitors all terminal sessions i n an operating system, su ch as Microsoft’ s Windows ® , for a special key sequence and if found, launches a command shell running with high privileges for use by the logged-on user, regardless of which user it was and without requiring subsequent authenticati on. The advantage of this method is that it allows any user to launch a command shell with high privileges even though the user may only have few privileges, and does not require a login with a username and password to be entered each time. VALUE Allows user to launch privileged command shells Simple command for authentication reduces user input
- jngreenlee 12y ago
  I was confused about this one. It appears that it may be for systems only where an authorized server with admin rights is running. I'll have to read more to be sure. Edit: Upon more reading from (https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&sa=X&ei=u6olVL_ZM4-GyASdzYKgAQ&ved=0CB8Q6AEwAA https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&...) It appears to be non-specific, but an admin computer is needed. [A] user-definable process is associated to the terminal services session. The user-definable process is selected so that the process can interact with the user connected to that terminal services session and can identify all the desktops registered in the terminal services session that the user-definable process is running in. [...] Again, by example, once a process has registered a low-level keyboard hook on a desktop, it is notified of all keystrokes that occur when the input for the keyboard would go to that desktop. Each Vista system prompt service process examines the keystrokes and if the user-definable key sequence (such as CTRL-F10) was pressed, the system performs the action of creating a command shell running as the LocalSystem account.

Technology Transfer Program S ecurity | Page 63 P ROVIDING A C OMPUTER U SER WITH H IGH -L EVEL P RIVILEDGES P ATENT N O .: 7,945,947 This invention monitors all terminal sessions i n an operating system, su ch as Microsoft’ s Windows ® , for a special key sequence and if found, launches a command shell running with high privileges for use by the logged-on user, regardless of which user it was and without requiring subsequent authenticati on. The advantage of this method is that it allows any user to launch a command shell with high privileges even though the user may only have few privileges, and does not require a login with a username and password to be entered each time. VALUE Allows user to launch privileged command shells Simple command for authentication reduces user input

jngreenlee 12y ago
I was confused about this one. It appears that it may be for systems only where an authorized server with admin rights is running. I'll have to read more to be sure. Edit: Upon more reading from (https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&sa=X&ei=u6olVL_ZM4-GyASdzYKgAQ&ved=0CB8Q6AEwAA https://www.google.com/patents/US7945947?dq=7,945,947&hl=en&...) It appears to be non-specific, but an admin computer is needed. [A] user-definable process is associated to the terminal services session. The user-definable process is selected so that the process can interact with the user connected to that terminal services session and can identify all the desktops registered in the terminal services session that the user-definable process is running in. [...] Again, by example, once a process has registered a low-level keyboard hook on a desktop, it is notified of all keystrokes that occur when the input for the keyboard would go to that desktop. Each Vista system prompt service process examines the keystrokes and if the user-definable key sequence (such as CTRL-F10) was pressed, the system performs the action of creating a command shell running as the LocalSystem account.