Go to:

IT Jobs

Another security researcher has found a way through Windows Vista's heavily hyped User Account Control (UAC) feature.

Robert Paveza, a web application developer with marketing firm Terralever, has published a paper (PDF) demonstrating a two-stage attack which he says allows malicious code to infect Vista systems even from accounts running under the limited privileges afforded by UAC.

The attack takes advantage of the fact that UAC permissions are somewhat porous, with programs able to ride on the coattails of other processes that are commonly granted higher privileges.

This is related to one of the flaws in UAC pointed out by security researcher Joanna Rutkowska in February. Rutkowska pointed out that the integrity levels (ILs) put into place by UAC are designed to allow certain breaches.

Under Paveza's attack, the malicious code would ride on seemingly innocuous software that could, in fact, run as advertised and without any elevated privileges needed, leaving the work of infection for later.

"For instance, if users believe they are downloading a 'Pac-Man' clone, such a game could be run while the malicious software did its work in the background," Paveza wrote. "It is important to note that, realistically, once the proxy infection tool has been run on the target machine, the target is effectively infected."

Meanwhile, the program could create an "executable stub" pointing to a target program that runs at a higher level. The stub would be stored in a place such as the Start menu where the user would click on it thinking to run the original, legitimate higher-level program.

When the user eventually clicks on the stub, the higher-level program is launched and the malicious program is loaded into the process, Paveza explained. By authorising the higher-level program the user also authorises the malicious code.

"The original target process and the malicious process then run in parallel," he wrote.

Microsoft in a statement downplayed the risk of the attack, pointing out that the attack requires significant user interaction and that not all users will have the privileges to authorise the malicious code.

However, Mark Russinovich, a Technical Fellow in Microsoft's Platform and Services Division, already answered all such criticisms back in February by explaining that UAC is not to be considered a security mechanism. Rather, it is a way of prompting developers to build more secure applications, he said.

"Vista makes tradeoffs between security and convenience, and both UAC and Protected Mode IE have design choices that required paths to be opened in the IL wall for application compatibility and ease of use," he wrote.

Because the boundaries defined by UAC and Protected Mode IE are designed to be porous, they can't really be considered security barriers, he said.

"Neither UAC elevations nor Protected Mode IE define new Windows security boundaries," Russinovich wrote. "Because elevations and ILs don’t define a security boundary, potential avenues of attack, regardless of ease or scope, are not security bugs."

Latest White Papers

Make internet risks and perils disappear
>> Download whitepaper

Data protection prospective vendor checklist
>> Download whitepaper

Beyond PCI Checklists
>> Download whitepaper