Windows Vista

Security model and vulnerabilities

Features of Vista Security Model
 User account protection (UAP)
 New in Vista
 Goal: implement least-privilege user accounts
 Accounts created during installation are protected
administrators and subject to UAP, and are limited user
accounts (LUA)
 When executing without restrictions, a protected
administrator user can make changes to key registry, start
services, and perform all privileged functions
 However, processes launched by that user (including
programs) do not inherit this full range of privileges
LUA (continued)
 Some processes cannot run properly
without administrator privileges
 These processes can be allowed to inherit the
full privileges from the administrator at launch
 A pop-up box will require the user to approve
privilege escalation
 Claim: no process escalate its privileges without
explicit consent from the protected administrator
Integrity levels (privilege levels)
Integrity access level System privileges

High Administrative (install to Program

Files folder, write system registry
entries, etc.)

Medium User (access to its Documents

folder and its section of the
registry)

Low Untrusted (access to Temporary

Internet folders and low-privilege
sections of current user’s registry)
Unprivileged user accounts
 Windows Vista (as XP) allows for the creation of
standard user accounts (without administrator
privileges)
 Creation of such accounts require additional steps
 Reasonable to expect that non-administrative accounts
will be the default in well-managed corporate networks
 Reasonable to expect that administrative user accounts
will be used by home users for all activities, including
browsing the web
Mandatory Integrity Control (MIC)
 Also referred as Integrity Levels
 New in Vista
 Controlled by Access Control Entries (ACE) in
System Access Control List (SACL)
 Applies to all securable objects (files, processes,
registry keys, etc.)
 Spawned process inherit parent’s privileges
 MIC is enabled/disabled through a windows registry
entry
SACL ACE types
SID Integrity Level

S-1-16-16384 System Mandatory Level

S-1-16-12288 High Mandatory Level

S-1-16-8192 Medium Mandatory Level

S-1-16-4096 Low Mandatory Level

Integrity enforcement
 A process cannot interact with another process at a higher
integrity level directly
 However, it is possible for a higher integrity process to directly interact
with a lower privilege process
 It is possible for a process with any privilege to interact through IPC
(named pipes,etc.)
 A lower integrity server to impersonate a higher integrity client using calls
such as ImpersonateNamedPipeClient, as long as the
impersonation level of the client allows it?!
 Registry entry keys have associated privilege levels.
 For instance, if IE has been given low privileges, it will only have access
to a limited section of the registry even if launched by a protected
administrator
Other restrictions
 A process is not generally able to send windowing
messages to higher-privilege processes sharing
the desktop
 Need to have explicit UI privileges in SACL
 Mechanisms to create processes that inherit only
some of the user’s privileges via
CreateRestrictedToken API. E.g:
 Removed privileges
 Match only DENY rules for an SID type
Elevation of process privileges
 Installer applications
 Has extension .msi, matches common installers, or has name SETUP.EXE
 Application has a compatibility entry in the registry key or a entry in the
compatibility database
 Manifest file contains requestedExecutionLevel or requireAdministrator
entries
 User manually selects “Run Elevated…” by right-clicking the application
in Windows Explorer
 Lauched through a privileged process without using the restricted API
 Fixed bug: Launched through TaskManager
 COM objects configured as such in the registry (either builti-in or
through user consent)
Lauching from Windows Explorer
 Windows explorer has a restricted token
and medium integrity level
 To launch processes at higher integrity
levels, it requests it to AppInfo Admin
Broker
 RunAsAdminProcess system call
 Requets user consent (pop-up box)
 Triggers CreateProcessAsUser
Registry virtualization
 Application developers have traditionally assumed
administrator privileges
 User-area registry files are written transparently if application
requests to write to registry and fails, lacking privilege
 User-area registry overrides system registry for that user
 Augmented by file virtualization:
 C:\Progra~1 (C:\Program Files) to: %UserProfile
%\AppData\Local\VirtualStore\C\P rogra~1
 In this fashion, unprivileged applications can modify a localized
win.ini, for instance
 Special virtualization rules apply to low-integrity processes such
as IE
IE7 in Protected Mode

Integrity Mechanism
IEInstal.exe
Administrative
IE7 in Admin Broker
Rights Required
(High IL)
protected
mode IEUser.exe
(Low IL) User Broker
User
(Medium IL) Rights Required

Compatibility
Layer Low Rights
Required
Registry protection
 Not only files protected, but registry entries
 Modifications of system files made only
through trusted installer
 Trusted installer called for updates (only accepts
signed updates)
 Resolves a major security issue with earlier
windows versions
Privilege escalation
 Processes by the same user can be running with medium or
high privileges
 Since a medium privilege process can write to the current user
registry, it can modify entries that control the behavior of the
same user’s high-privilege processes (if written to that user’s
registry)
 By default, user processes and files have medium integrity level,
while IE7 (as before) is low integrity
 Examples of privilege escalation from low  medium  high 
local system are provided by Matthew Conover, Principal
Security Researcher, Symantec Corporation, in “Analysis of the
Windows Vista Security Model,” a SYMANTEC ADVANCED
THREAT RESEARCH technical report
Low to Medium
 IE7 cannot write files in the user account or
the medium integrity area of the user
registry, including adding startup items
 But it may be able to connect through the
loopback interface to a file sharing service and
achieve the same result
Medium to High
 Program runs in the background, listening to calls
to consent.exe
 When it is called, it checks if it has write privileges to the
caller
 Overwrite the caller with its own malicious code
 Launched w/ high privileges
High to LocalSystem
 If the high integrity process launched is not LUA restricted,
it can
 Take ownership of security objects
 Change all registry files to grant administrators full privilege to
system modification
 Apply patches to libraries that disabled signature checking for
system files
 Modify the operating system arbitrarily
 There is no longer monitoring of modification of system
files
 Still, overall a much stronger security architecture than
earlier versions of windows