Hot answers tagged

16

A "Secure Desktop" is a desktop that can only be run by the system itself. That sounds a bit weird, and probably doesn't explain much. In Windows, a desktop is a view that allows you to interact with processes. When you log into Windows (the log in prompt) you are on a desktop. When you are logged in, and see the start menu, you are on a seperate desktop....


14

This is not really an answer, but speaking in absolutes with security can be dangerous... so... it depends. I think when you say "Microsoft said UAC is not a security barrier," this is probably what you mean: From Security Watch: The long-term effects of User Account Control (2007): What UAC Is Not UAC was not deliberately designed to be the most ...


12

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit ...


9

The issue is that %APPDATA% can be written to by any application being run by that user (%APPDATA% is different for each user) - any app that is run can add a plugin there, which may do something evil if enabled. In modern versions of Windows, the installation directories (i.e. Program Files) are protected, only elevated processes/users can write there. ...


6

Acting as Windows is called running as SYSTEM. SYSTEM is the user account that has the lowest level access and can do anything on, well, the system. Windows uses the SYSTEM account to run key services that keeps the system in order. If you can run as SYSTEM then yes you can pretty much do anything you want on that machine. The problem is that it's really ...


6

Short Answer Use a limited account for performing the day to day activities and have a separate account with administrative privileges for performing tasks that require elevated privileges. Long Answer User Access Control is not considered a security boundary by Microsoft. The reason is that due to the design of Microsoft Vista and later, processes hold ...


5

What Julian says is not correct. The odds of malware getting a foothold are unchanged. If you can encrypt all your data, so can malware. If you can send packets, so can malware. What's different between running as an admin and a less privileged user is the effort that malware must expend to persist or survive when you run antivirus software to clean ...


4

When they run the script as a Local Administrator, it fails with access denied. Then this means that being a "Local Administrator" is not sufficient to run the script. This proves that "Local Administrator" does not cover the full set of rights on the machine. In the context of UAC, a "Local Administrator" does not have the full rights of an "administrator" ...


4

I will provide you the technical details of the exploit you are talking about and then let you decide yourself whether you should worry or not. The bypassUAC exploit exploits a bug (or rather a feature) of Windows operating systems where processes signed by the Microsoft code signing certificate don't prompt the user when it escalates its privileges to ...


4

UAC is, in my opinion, too highly praised. True, it does protect against the more simplistic admin-requiring malware installation scenarios which were more prevalent before its advent, but it created new such scenarios, which are not much better. In short, all that UAC changed is the following. Before it came to be, malware authors could make malware that ...


4

Your work computer belongs to your company, not you. If your boss needs you to install a piece of software to do your job better, have him ask the admins to install it. If not, do not try to violate their rules and install it yourself. Why not? Because of all the trouble you could be blamed for creating. If the software came with a vulnerability that ...


4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (...


4

The phrase "security barrier" can be ambiguous. I think it may be more useful to consider the concept of a security guarantee, sometimes called a security boundary. More here. Basically, a security guarantee is a statement about the intended behaviour of the software. Any way to violate a security guarantee (within the appropriate scope) represents a ...


3

Remember, the "U" in UAC stands for User. In the case of a kiosk, who is the user? Almost certainly it will not be you. What good outcome could you expect from UAC on a kiosk? Do you expect it to prevent the installation of malware if someone is surfing to evilsite.com? Do you expect the bored kid who surfed to evilsite.com to tap "no, I didn't mean to ...


3

A legitimate reason for consent.exe to connect to the Internet is to figure out whether a certificate was revoked (by updating the certificate revocation list, CRL). I was however unable to confirm this with Wireshark. Using the Wireshark filter http contains "crl" didn't give any results on my machine. This could be, because traffic encrypted. Each ...


3

You asked 1) if consent.exe is a legitimate program, 2) if its use of the network is legit (why does it attempts to connect to an external server), and 3) if there is any reason to allow it. Your questions (and some commentary) follow. The short answer is that it is OK, and no, you don't want to block it: Legit? Kudos for checking the genuine M$ origins ...


3

How are malware able to start on boot on windows without administrator rights? Find a Service which runs an executable which a user can overwrite (Hint: Installed software that has its own updater usually fits the bill.) bitsadmin (see this example) can run on schedule or on event, and call a handler program, specified by a user. if a malware doesn't ...


2

I use programs in my computer such as the commercial Faronics Anti-Executable and the free version of NoVirusThanks EXE Radar. These programs whitelist all the existing programs in your computer at setup and then for every new program that executes they ask you for permission to allow execution. In other words you have control over the future program ...


2

Setting the TECHNIQUE option to PSH for Powershell appeared to solve my AV evasion problem. Anti-virus does not detect malicious Powershell code nearly as well (if at all) as executable code. Thanks to @Michael for his answer, although exploit/windows/local/ask appeared to overwrite the manually uploaded payload with whatever was set in FILENAME during my ...


2

A UAC prompt appears on the secure desktop, so the normal Windows desktop (and any other open windows) are dimmed, behind a translucent black layer, with the prompt itself shown at full brightness overlaying the dimmed area. It should be centered on the main display, and contain the program name, verified publisher (in bold) and, in the case of running a ...


2

Ransomware wouldn't need to raise a UAC alert as it is after a user's personal files, not system files.


2

Whatever reasons UAC should be kept enabled, it aims (at least theoretically) to mitigate the impact of a potentially malicious program. According to Microsoft: Under certain constrained circumstances, disabling User Account Control (UAC) on Windows Server can be an acceptable and recommended practice.These circumstances occur only when all the ...


2

Applications installed using something like the "for myself only" option go in that user's AppData folder. Malicious software run from another non-privileged user's account cannot (without exploiting a vulnerability) damage content within the AppData folder of another user if the system permissions haven't been misconfigured. The defaults leave this ...


2

Generally, using an application whitelist will not only restrict what apps the user can directly launch, but also what apps the whitelisted apps can launch (after all, explorer.exe - the Windows graphical shell, which hosts the desktop, Start menu, taskbar, file browser, and so on - is itself just a process that launches other processes when told to do so). ...


1

This actually is possible using a little tool called AutoHotkey. This could be done by taking a screenshot of the desktop (assuming there is nothing on it) or using the desktop's image file then displaying it using a GUI, adding a dimmer overlay, making a UAC-looking prompt, then setting them to be "always on top". Then making an output variable to a text ...


1

You've already answered your own question if malware runs, I've lost Running as a standard user greatly reduces the risk of allowing malware to get a foothold. It isn't about drivers necessarily, it is about malware that is able to entirely encrypt your data or even worse potentially, start leaking data without you knowing or maybe using your computer ...


1

They are both essentially the same, let's think of the possible scenarios. an attacker takes over a single user an attacker has admin or more permissions on the machine Since Uac runs in a restricted desktop the standard user has no access to that desktop object, meaning that any keylogging, injection or screen logging activity done in this permission set ...


1

It should not be possible to use the service to bypass some security e.g. to elevate privileges. Everything else is treated as a bug. Unfortunately there were a bunch of bugs in the past (for example CVE-2017-7760, CVE-2016-5253, CVE-2015-4505) which allow a local attacker to elevate privileges via the mozilla maintenance service. If you are worried about ...


1

There are many other ways to bypass UAC regardless of the use of metasploit, since you are talking about Flash plugin, your "exploit" is going to be delivered via a browser. If you take the example of the recently discovered file-less malware "Dimnie", the payload is dropped using Powershell, to avoid static detection it introduces characters which the ...


Only top voted, non community-wiki answers of a minimum length are eligible