2

We are considering to build a Windows application that is split in 2 parts:

  • one Windows service
  • some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell.

Additional info:

  • The service and the Add-Ins are digitally signed with a company certificate.
  • All running on the same machine.
  • The service runs in a different user account than the Add-Ins.
  • The Add-Ins may run in various interactive user accounts.

The Add-Ins need to communicate with the Windows service to exchange a secret that is known to the service only, but is needed at the Add-Ins to get access to some sensitive data. Therefore the Add-In would connect to the service (via e.g. named pipe) and requests that secret on demand.

But we need to avoid that another application/process does the same and gets the secret. Only those Add-Ins that belong to our application (that are digitally signed with our certificate) may get the secret. In other words, the Add-Ins need some way to authenticate themselves to the service.

So my questions are:

  • How can an Add-In or a running process authenticate itself to the service while requesting the secret?
  • Is it possible to use the digital signature (or something else that is unique to it and to the service) for this?

For an Add-In, it might get more difficult when considering that it is hosted by a process that might be signed with different certificates (e.g. Word.exe, mmc.exe, ...).

We are implementing on the .NET Framework.

Thanks for any kind of help.

0

Your very design - treating non-sandboxed processes running with the same privileges and owner as yours as untrusted - is incompatible with the Windows security model.

There exist ways to authenticate an application to another via IPC, and even to verify the binary that an application is running from and the signature on that binary. However, there is no way to prevent the following cases which would break your security objective:

  • a DLL loaded into the add-in / client process has created a hostile thread that can read the process memory, turning the client untrusted.
  • another process has used debug APIs to modify the client process in memory, turning the client malicious.
  • another process uses debug APIs to read the secret out of the client process after its retrieval (processes have ACLs which could prevent this, but any process with the same owner can overwrite that ACL).

Note that some of these could be prevented by doing things like checking the loaded DLLs or ACLs of the client process, or checking for open HANDLEs to the client process in other processes. However, these all fall victim to "Time Of Check to Time Of Use" (TOCTOU) attacks, where the attacker can ensure that the check passes (the client looks clean and trustworthy) and then invalidate the check result (inject DLLs, change ACLs, etc.) prior to the use of that check result (the service actually returning the secret).

Additionally, it is of course possible for any privileged (admin / SYSTEM / has SeDebug privilege) process to read the secret right out of your service's address space, without bothering with cooperative IPC mechanisms. Consider that MMC is frequently run as Administrator, implying that the user running it at least has the ability to launch privileged processes.

Leaving aside the privileged process case, though, you can avoid exposing the secret itself (assuming it's stored somewhere that other non-privileged users can't read) by instead having the IPC channel function as a relay for the information. That is, instead of the IPC client saying "Hey service, what's the secret?" and then directly using the secret to get the sensitive data, the IPC client could say "Hey service, what's sensitive data ?" and get the data without ever learning the secret.

Of course, this doesn't prevent that data from being exposed to other processes. Nor does it prevent other processes from taking over the legitimate IPC client and making it request all the sensitive data for them. At the end of the day, if you don't trust the programs that the user is running with the same privileges that they are using to run your process, you are trying to do the impossible. In that scenario - where the user themselves is potentially hostile (since they are presumably choosing to run, or at least enabling the running of, processes that want to steal your secret), there is no way in "full" Windows to prevent the user (or one of their "agents" i.e. processes they run with their full privileges) from learning a secret in one of their own processes.

Now, in fairness, you can make it hard to pull off such attacks. That's what DRM (in the form of media or software license checks) tries to do: it can't put a security boundary between the process and the secret (such as a license key, encrypted media key, or similar), so DRM authors put up what one security researcher described as a "nonsense boundary" instead. If the target process' address space makes no sense, and the process itself is constantly checking its own integrity and the binary is so obfuscated that it's hard to reverse engineer and remove all those checks quickly enough, then it can be quite hard to extract secrets from it. Still possible with time - anybody familiar with the history of DRM will note that most DRM schemes of interest to anybody (and some that were pure curiosities) have been cracked, sometimes very quickly - but maybe getting at least a short time is sufficient?


A few good questions, at this point, are:

  1. What assets are you trying to protect, and how valuable is each one?
  2. Where are the assets stored, and what are the trust boundaries around them?
  3. Who are the attackers, that would want to access the assets? (If the user or any system admin is a potential attacker, you're squarely stuck on the DRM problem).
  4. What are the attackers' privileges (if they're low, such as sandboxed Windows Store apps, then that's not a problem; if they're the same as your own - as seems to be the case - you have a problem)?
  5. What are the practical attack vectors by which the attackers could try to access the assets? Answering this question requires thinking about everything each attacker can do - for example, things like the ReadProcessMemory API or potentially reading secrets right out of the file system or registry if they have enough privileges to satisfy, overwrite, or bypass the ACL - and is the part that is often trickiest for a novice to enumerate, but if you provide the info others can help you (as we've tried to do here).
  6. For each attack vector, how severe is the actual threat (likelihood of successful attack multiplied by damage)?
  7. How severe does a threat need to be before it becomes important to avoid it? In other words, how much risk can you accept?
  8. For each threat that poses too much risk, is there any way to mitigate it?

This process - enumerating the assets, their protections, their attackers, the potential attacks against them, the threat due to each potential attack, and mitigations (if any) for those threats - is called threat modeling, and is very useful.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.