4 ms·

Privilege Escalation on Windows 8/UEFI Systems

• templeos2 12y ago
  Microsoft made a deal with IBM. I made a deal with God. You are retarded if you don't understand NIST random number beacon. Here is the hierarchy 1) God's courts 2) Supreme court 3) lesser courts Do you understand, nigger? Dumb fuck.
• deleted 12y ago
  [deleted]
• Someone1234 12y ago
  "privileged userland process" is a circular way of saying administrator. They claim administrator is "ring 3" or "admin ring 3" which is super-confusing... Essentially what this is is a way of installing malware into the kernel bypassing the driver signing requirements. You need admin access already. It might be useful, but they're clearly trying to make it appear more significant than it is by their technically inaccurate word choices.
  • Igglyboo 12y ago
    IIRC windows only has two permission levels anyway, user and admin.
    • snfernandez 12y ago
      Actually, there are many integrity levels for user's processes in Windows: untrusted, low, medium, high and system. (http://msdn.microsoft.com/en-us/library/bb625963.aspx http://msdn.microsoft.com/en-us/library/bb625963.aspx)
      • Someone1234 12y ago
        To quote Wikipedia[0] ("Architecture of Windows NT"): > While the x86 architecture supports four different privilege levels (numbered 0 to 3), only the two extreme privilege levels are used. Usermode programs are run with CPL 3, and the kernel runs with CPL 0. These two levels are often referred to as "ring 3" and "ring 0", respectively. Such a design decision had been done to achieve code portability to RISC platforms that only support two privilege levels, though this breaks compatibility with OS/2 applications that contain I/O privilege segments that attempt to directly access hardware. [0] https://en.wikipedia.org/wiki/Architecture_of_Windows_NT#Kernel_mode https://en.wikipedia.org/wiki/Architecture_of_Windows_NT#Ker...
        • drzaiusapelord 12y ago
          Except MS has implemented software-based permission groups, which the person you're replying to pointed out. This really low level x86 stuff doesn't mean you can't have more granularity. Windows has system, high, medium, low, and untrusted security levels that get mapped to security groups. A local admin is high, but not system, etc.
          • Someone1234 12y ago
            Indeed, but it isn't a "ring." A protection ring has a specific meaning and that meaning IS about "low level [CPU] stuff." For example the CPU can be made to support more than two rings, Windows NT and UNIX just only utilise two of them and then build software protections on top (OS/2 supported 3). https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring
  • snfernandez 12y ago
    > "privileged userland process" is a circular way of saying administrator. They claim administrator is "ring 3" or "admin ring 3" which is super-confusing... It doesn't seem a circular description but the full technical one, at least from a processor privilege point of view. And I find it pretty amazing, they are invalidating the whole purpose of the UEFI without needing to execute ring0 code.
  • userbinator 12y ago
    I think if you are the admin/root you own the machine anyway, so there's really no vulnerability here. Essentially what this is is a way of installing malware into the kernel bypassing the driver signing requirements. It's funny that being able to load unsigned drivers and/or access hardware directly from userspace in Linux when you are root is not considered a vulnerability, whereas on Windows it is... and it agrees with my hypothesis that proprietary operating systems are moving towards a model of "execution of any code that isn't approved by Microsoft/Apple/Google/$some_corporate_entity is a vulnerability."
    • cesarb 12y ago
      Loading unsigned drivers and/or accessing hardware directly from userspace in Linux when you are root and have booted with UEFI "Secure Boot" enabled is considered a vulnerability. If it weren't, Microsoft would not sign the shim Linux distributions use.
• al2o3cr 12y ago
  "Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its privileges from ring 3 all the way up to that of the platform firmware, which attains permanent control of the very-powerful System Management Mode." That's the part to get worried about right there - fiddling with SMM is Serious Business. For instance, it's the sort of place NSA hides rootkits: http://en.wikipedia.org/wiki/System_Management_Mode#Problems http://en.wikipedia.org/wiki/System_Management_Mode#Problems