3

If I run KeePass as a normal application, any other application (e.g. browser) can do code injection and get my passwords.

However if I run KeePass with admin rights, my browser cannot get into it. Not even get the master password with keylogging, nor modify the Program Files folder.

Am I missing something here?

Assume that I'm running a non-discontinued Windows OS (e.g. Win7 and not XP) and I have an antivirus software installed. User account has admin privileges.

Improve this question

2 Answers 2

Reset to default
1

Running KeePass (or any other application) as administrator changes the integrity level. Objects of the same integrity level can potentially interact and modify each other, but an ojbect of a lower integrity level cannot modify an object of a higher integrity level. If you start your browser and KeePass both as a normal user, the integrity level of both will be set to "medium". If you start KeePass as an administrator, however, its integrity level will be set to "high" and its resources will be protected from processes that have lower integrity levels.

So, does this mean you should run KeePass as as administrator? To some degree it depends on your threat model. The general wisdom would hold that you shouldn't run with more privileges than are necessary, and if an attacker has the ability to arbitrarily modify running processes on your machine, you've already lost anyway. Unless you have very specific threats you face and you can articulate the reasons these threats put you at greater risk by following the conventional wisdom than by going down an alternate path, I would say that no, there is not such a significant security benefit to choosing to run as an administrator instead of a normal user that it would clearly justify it.

Improve this answer
11
  • Yeah, that's what I wrote in the question. So what is the answer - should I run it as an administrator or not, will it help against a hijacked browser and not fail elsewhere?
    – Abyx
    Sep 8, 2016 at 14:19
  • 1
    @Abyx Ah, you explained the effect in your answer, I thought you were looking for the mechanism. I'll expand the answer.
    – Xander
    Sep 8, 2016 at 14:30
  • 1
    Are you sure that just by having the same integrity level you immediately get all the privileges to write to other processes memory? Security wise this sounds so incredibly stupid and insecure I'm not buying that without a source.
    – mroman
    Sep 8, 2016 at 14:35
  • 1
    @mroman yes. but you might want to ask it as a separate question, maybe on SO. Btw you can check it by attaching a user-mode debugger.
    – Abyx
    Sep 8, 2016 at 14:38
  • @mroman Nobody said that you could immediately write to another process' memory.
    – Xander
    Sep 8, 2016 at 14:41
0

There's a thing called "Process Isolation". Any sane, modern operating system isolates process spaces exactly so that different processes can not just interfere with each other by arbitrarily writing into/reading from each other's memory. There are methods to allow processes to communicate (Keyword: IPC) but in general processes are isolated from each other in any sane operating system.

If there's a good Keylogger present on your system then it'll log every keystroke globally so it doesn't matter under what account a program was launched.

Edit: Operating systems can of course exposes APIs that will allow processes to monitor/control other processes but in a sane operating system you either need special privileges to do that (such as being localadmin) or you need to be the parent process of the process you're trying to control or need permission from the other process.

Improve this answer
3
  • It doesn't answer the question. And I'm asking about specific OS - Windows (7 and newer).
    – Abyx
    Sep 8, 2016 at 14:16
  • Alright, then you should specify this in the question because 'windows' is a rather generic term with huge difference between versions. More technically: On Windows to read another processes memory you will need PROCESS_VM_READ permissions (unless there's some security vulnerability somewhere). To actually control/monitor every process you like you need debug permissions (SeDebugPrivilege) I think. If you launch another process as a subprocess of your own you'll receive PROCESS_ALL_ACCESS giving you all access. However, you don't have these permissions for other processes.
    – mroman
    Sep 8, 2016 at 14:22
  • If you need all the technical details you should read the documentation about Windows' Access Control Model - which you can easily find on MSDN.
    – mroman
    Sep 8, 2016 at 14:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .