2

Forgive me if this question seems a little "under the hood", but I think it's important to know from a security point of view.

I see SPOOLSV.EXE runs with print driver DLLs (Type 3 - User Mode, I know) loaded into the process under the security principal NT AUTH\SYSTEM. Doesn't this mean print drivers can pretty much do whatever they want? Is there a way to run them in more restricted context? Think Print Server that doubles as domain controller...

Thanks.

Improve this question
1
  • Spoolsv is a system level service, so it has system level privileges. It needs to interact with hardware so this isn't too surprising. There are ways to lock down the system so that only system admins can install printer drivers, but this should also be applied to all drivers anyway.
    – RoraΖ
    Aug 15, 2014 at 13:33

1 Answer 1

Reset to default
1

In general, drivers can access hardware (that's their point), meaning that they have enough privileges to do whatever they want with the machine. Some operating systems try to somehow constrain some drivers to only a specific subset of the hardware, but it is hard (e.g. if the hardware can do DMA then it takes some effort and some hardware support to ensure that an hostile driver cannot read or write any piece of RAM that it wishes to access).

This is why recent versions of Windows insists on drivers being digitally signed: the signature does not guarantee the safety, but it allows to lay blame and is therefore expected to prevent most attacks (attackers really don't like it when police forces break through their door at 06:00 AM).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .