Windows 7 beta UAC completely vulnerable to malware

[+Gary7 Subscriber²]

Source

Chicago (IL) - An almost unbelievable flaw in Windows 7 beta and Microsoft's User Account Control (UAC) feature - the one designed to keep all of the annoying messages seen in Vista away from its users - allows its protection to be defeated by any malware which happens to infect the system. The malware needs only to send a series of false keystrokes from a Visual Basic script to activate the UAC dialog, move the slider bar to the disable position, and then save the changes. After that, the program can access protected functions or even reboot the system, thereby gaining full total system access on restart.

This type of security breach has been in use for as long as there have been PCs. In the old DOS days, a terminate and stay resident (TSR) program could invoke the system BIOS functions, wait for the password screen to appear then start issuing interrupt 16h instructions (which send fake keystrokes). Doing so would mimic the effect of a user pressing keys on a keyboard, and old DOS programs like Sidekick used to do this as part of their feature in order to provide DOS with copy-and-paste-like functionality, as well as pop-up abilities like a calendar, calculator, etc. Sidekick would intercept and send its keystrokes in this way.

Over the years, similar techniques were employed to bypass security in later operating systems. Such programs could repeatedly try various password combinations, for example, at very high speed one right after the other. Early on system designers began to realize this weakness and developed the "three strikes and you're locked out" policy. But today in Microsoft's upcoming flagship operating system to be released later this year, Windows 7, such antiquated attempts aren't even necessary.

Windows uses a message-based communication system internally. When a user presses a keystroke on the keyboard, the keyboard controller identifies which key was pressed (or released) and sends a signal to the motherboard, which then issues a hardware interrupt signal to the CPU. The CPU stops what it's doing (processing a spreadsheet, drawing some graphics in a game, whatever it is), and then retrieves the keystroke - sending it to the appropriate software algorithm (an internal keyboard handler). Such a handler allows keys to be remapped, intercepted, and all kinds of other things which allow for abilities macros, etc. But ultimately, the keystroke message, such as "KEY 'X' IS DOWN WHILE THE RIGHT-SHIFT KEY IS PRESSED," are sent to the appropriate program (or, more precisely, the appropriate "window" in Windows).

This newly discovered "flaw" is actually not a flaw at all (see below). It employs something similar by using the "SendKeys" function in Visual Basic which mimics the process explained above in today's Windows operating systems. When a window receives a keystroke sent by SendKeys, the program assumes it came through legitimate channels and is really a valid key. There is no testing which takes place to find out if it was programmatically inserted into the queue, or if it was the result of a real keypress.

As a result, using only keystroke commands issued by a malware program, in Windows 7 beta it can activate the UAC, move the slider bar to the "disable messages" position, close the dialog and then proceed through the system doing whatever it wants to in the background without the user ever knowing that their system's been compromised - because they don't see any popups as their UAC setting should've indicated.

The discoverer wrote some simple code (which can be downloaded from his page) and also notes that this is apparently a Microsoft-purposed design feature of Windows 7, as related inquires appearing on Microsoft's beta page are all marked "closed."

[MagicAndre1981]

we already know this ;) Read the news on the front page

[azz0r_wugg]

Fresh news!

[tomwarren Veteran]

already posted

https://www.neowin.net/news/main/09/01/30/m...ows-7-by-design