Feeds

Windows 7 UAC flaw silently elevates malware access

Weak links in chain of trust

Remote control for virtualized desktops

Researchers have uncovered yet another flaw in Microsoft's Windows 7 beta that could allow attackers to gain full administrative privileges by bypassing the operating system's UAC, or user access control.

Researcher Rafael Rivera Jr. has released proof-of-concept code that demonstrates how unauthorized third-party software can elevate its privileges and install a potentially malicious payload on the latest version of Windows, which is still in beta. Researchers warn that anyone using the OS is vulnerable.

"Unfortunately this flaw is not just a single point of failure," writes security blogger Long Zheng. "The breadth of Windows executables is just too many and too diverse and many are exploitable."

The vulnerability stems from Microsoft's attempts to make UAC more palatable by allowing certain applications to make changes to the OS without first prompting the user for permission. Executables that are digitally signed are essentially given fast-track permission under UAC's default configuration. And it turns out many of these third-party executables are in turn able to invoke still more third-party code.

This gives rise to what Zheng calls "piggybacking," in which a proxy executable launches an elevated instance of rundll32.exe, a file that has existed in one form or another since before the days of Windows 95. Rundll32.exe can then point to a malicious payload, and because the payload has inherited the administrative privileges from its authorized parent process, UAC never prompts the user.

Rivera's proof-of-concept uses a one-line file called Catapult.exe as the proxy application that launches the rundll file. That in turn is able to execute a multi-line C++ program called Cake.dll, which reads the current process token and shows an on-screen message box. Of course, an attacker could do much more nefarious things.

A Microsoft spokesman said: "We are not aware of anyone impacted by this issue at this time, but it has already been addressed in a later internal beta build." In the meantime, Windows 7 users may want to set UAC to "high." ®

Internet Security Threat Report 2014

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.