User Account Control (UAC) is a security feature, not a security boundary

MrBrian · Apr 25, 2014

From UAC: Desert Topping, or Floor Wax? (I'll give longer quotes because the page isn't formatted properly):

Security is the preservation of the three properties of confidentiality, integrity, and availability.

Confidentiality means that your stuff is not disclosed unless you want it disclosed.

Integrity means that your stuff is not changed unless you want it changed.

Availability means that you, your users, customers, etc. can still use your stuff.

Security Feature: some kind of feature, widget, or thingie that makes it somewhat more likely that your security, as defined above, will be preserved.

Security Boundary: this is a special term to Microsoft. It means that if someone discloses a way to violate a Microsoft-defined security boundary, that Microsoft will release a security patch as soon as possible, so that the method to violate the boundary no longer works against patched systems.

Clearly, all security boundaries are security features, but not all security features are security boundaries.

[...]

Does UAC provide a security boundary? That depends on which kind of user you are using, and how you use it.

Standard User Without OTS ["Over The Shoulder" elevation]: this is a security boundary. There should not be any way for a non-privileged process to elevate to a privileged process, and if someone finds one, then Microsoft should issue a patch. Caveat: this is excluding mis-configurations such as 3rd party software running with privilege or weak security settings.

Standard User With OTS ["Over The Shoulder" elevation]: this is questionable. There should not be any way to elevate, but in practice the OTS elevation presents potential area of attack. The attacker could inject malicious code into the user’s context, and it may trigger once the OTS elevation completes and the Administrator token is available.

Administrator in AAM [Admin Approval Mode]: this is definitely not a security boundary. With the Administrator token available in the user’s space, it is too easy for malware to attack something in this very broad attack surface and gain elevation without the user’s approval. Microsoft could not patch this barrier without substantially breaking application compatibility.
Click to expand...

Log in or Sign up

User Account Control (UAC) is a security feature, not a security boundary

MrBrian Registered Member

Log in or Sign up

User Account Control (UAC) is a security feature, not a security boundary

MrBrian Registered Member

Useful Searches