path: root/attacksurface.md
diff options
authorJason A. Donenfeld <Jason@zx2c4.com>2019-05-02 16:26:20 +0200
committerJason A. Donenfeld <Jason@zx2c4.com>2019-05-02 16:34:37 +0200
commita0cda2c718e96612138a079de7233166dc964ee2 (patch)
tree1f80ab3763e7f6698f5a53ec500c4ad27b7e2a7f /attacksurface.md
parentservice: correct sid bounds (diff)
service: set security attributes on new process
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'attacksurface.md')
1 files changed, 3 insertions, 1 deletions
diff --git a/attacksurface.md b/attacksurface.md
index e655e9fc..f8b16bf1 100644
--- a/attacksurface.md
+++ b/attacksurface.md
@@ -35,7 +35,9 @@ The manager service is a userspace service running as Local System, responsible
The UI is an unprivileged process running as the ordinary user for each user who is in the Administrators group (per the above). It exposes:
- - There currently are no anti-debugging mechanisms, which means any process that can, debug, introspect, inject, send messages, or interact with the UI, may be able to take control of the above handles passed to it by the manager service. In theory that shouldn't be too horrible for the security model, but rather than risk it, we might consider importing all of the insane things VirtualBox does in this domain. Alternatively, since the anti-debugging stuff is pretty ugly and probably doesn't even work properly everywhere, we may be better off with starting the process at some heightened security level, such that only other processes at that level can introspect; however, we'll need to take special care that doing so doesn't give the UI process any special accesses it wouldn't otherwise have.
+ - The manager service (above) calls `GetSecurityInfo(DACL_SECURITY_INFORMATION)` on itself, and passes the returned security attributes as the UI's process and thread attributes in the call to `CreateProcessAsUser`. This means that debugging the UI process (in order for another process to steal its handles and exfiltrate private keys) is only possible by processes that can debug the manager service.
+ - We do not add `ATTRIBUTE_SECURITY_INFORMATION` into the requested information of `GetSecurityInfo`, which means the UI process only requires medium integrity to run it. Requiring greater integrity level access prevents the process from running properly, unfortunately (`ERROR_PRIVILEGE_NOT_HELD`). It would be nice to require high integrity to open the process, without having to increase the privileges that the process has in its own token.
+ - Perhaps due to the above and other reasons, it appears that it is possible for other processes to write into the UI process's message loop, which is bad, and might defeat the purpose of the above.
- It renders highlighted config files to a msftedit.dll control, which typically is capable of all sorts of OLE and RTF nastiness that we make some attempt to avoid.
### Updates