diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2019-09-03 12:11:39 -0600 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2019-09-05 22:03:21 -0600 |
| commit | 30c235c541544222926e0db8afca94e017f93054 (patch) | |
| tree | 4d8a3ac524f0b6f6b1af59d9b52d672baf39a2db /attacksurface.md | |
| parent | ui: add gridlines to log (diff) | |
| download | wireguard-windows-30c235c541544222926e0db8afca94e017f93054.tar.xz wireguard-windows-30c235c541544222926e0db8afca94e017f93054.zip | |
attacksurface: mention named pipe escape hatch
Diffstat (limited to 'attacksurface.md')
| -rw-r--r-- | attacksurface.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/attacksurface.md b/attacksurface.md index ad37ddad..878b212f 100644 --- a/attacksurface.md +++ b/attacksurface.md @@ -16,7 +16,7 @@ Wintun is a kernel driver. It exposes: The tunnel service is a userspace service running as Local System, responsible for creating UDP sockets, creating Wintun adapters, and speaking the WireGuard protocol between the two. It exposes: - - A listening pipe in `\\.\pipe\ProtectedPrefix\Administrators\WireGuard\%s`, where `%s` is some basename of an already valid filename. Its DACL is set to `O:SYD:(A;;GA;;;SY)`. This pipe gives access to private keys and allows for reconfiguration of the interface, as well as rebinding to different ports (below 1024, even). Clients who connect to the pipe run `GetSecurityInfo` to verify that it is owned by "Local System". + - A listening pipe in `\\.\pipe\ProtectedPrefix\Administrators\WireGuard\%s`, where `%s` is some basename of an already valid filename. Its DACL is set to `O:SYD:(A;;GA;;;SY)`. If the config file used by the tunnel service is not DPAPI-encrypted and it is owned by a SID other than "Local System" then an additional ACE is added giving that file owner SID access to the named pipe. This pipe gives access to private keys and allows for reconfiguration of the interface, as well as rebinding to different ports (below 1024, even). Clients who connect to the pipe run `GetSecurityInfo` to verify that it is owned by "Local System". - A global mutex is used for Wintun interface creation, with the same DACL as the pipe, but first CreatePrivateNamespace is called with a "Local System" SID. - It handles data from its two UDP sockets, accessible to the public Internet. - It handles data from Wintun, accessible to all users who can do anything with the network stack. |