4

In order to protect a Windows administrator account from attacks such a Pass-the-Hash and other Token Passing tehcniques (e.g. via Incognito tool), can you tell me if it is a good idea to remove the privilege "SeImpersonatePrivilege" on which Incognito rely on ? If this privilege is removed, it should be impossible to impersonate a token, right ? (of course we assume the admin does not need this privilege in his tasks).

On the other hand, a malware with admin privileges can call PrivilegeCheck and then add the "SeImpersonatePrivilege" privilege to the admin account.

That's why I am asking if removing SeImpersonatePrivilege is a good & strong idea ? Or useless ?

Thank you.

  • It may offer protection in terms of the fact the malware probably assumes if it's running as an admin, it will have that permission and crash when it attempts to leverage it. The other issue is it depends on how the malware obtained administrative privileges - it may not just be relying on running under the current users credentials, eg by exploiting privilege escalation flaws in other running processes. – deed02392 Jan 9 '14 at 16:05
3

On the whole, as long as Administrator has sufficient privileges to do his administration tasks, then he can more or less directly take full control of the machine. For instance, any user who can tap into kernel memory can alter the tables which define his own privileges, and give himself all possible privileges.

Removing a specific privilege may help only in the case that some malware runs on the machine and trips on the lack of privilege, even if putting it back would be easy. This assumes that installed malware is mindless. Moreover, if malware may break on the lack of SeImpersonatePrivilege, then non-malware software may equally break.

This is equivalent to putting a bear trap in your living room. A potential burglar, groping in the dark in search of your valuables and unaware of your cunning ambush, might trigger the trap and be incapacitated. However, this works only as long as burglars do not adapt: if too many people put bear traps in their living room, then burglars will learn to use a torchlight to see where they are walking. Moreover, no bear trap would change the disturbing fact that a burglar did enter your house, and can still enact considerable mischief without stepping into the living room. Finally, the trap may backfire: you could also inadvertently walk into your own trap.

  • +1 "the disturbing fact that a burglar did enter your house, and can still enact considerable mischief "... See CryptoLocker which does much mischief even without any admin privileges. – Ben Jan 9 '14 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.