G Data: Windows User Must Install Optional UAC Patch

Windows users would be wise to install an optional update for Windows, other malware can use a trick to get unnoticed administrator rights on the computer, so advises the German anti-virus company G Data.Following the spread of the Dridex malware.

This is a Trojan horse that recently in Belgium for major damage caused by the banking system to attack the Belgian companies use. The malware spreads via e-mail and MHTML document. This document contains a macro that attempts to download a "downloader". The downloader will place the final malware on the system. If the user macros enable the downloader is downloaded in Microsoft Office. To get administrative rights on the computer downloader tries to bypass the UAC window.

Windows User Account Control (UAC) is a security measure designed to protect computers from Microsoft as "hackers and malicious software." As software or a user wants to change some Windows settings or try to perform actions that require administrative privileges displays a UAC warning. The downloader adjusts according to G Data to a popular trick to hide the UAC warning. It uses a customized file SDB . In this case, Windows will not show because UAC window.

Microsoft has released a patch developed that allows the UAC warning is also shown in this case, but this is an optional update. "The malware creators abuse a weakness in Microsoft's operating system to be without displaying the UAC notification system. Therefore, we strongly recommend to install the Microsoft patch, Microsoft even designates it as a required patch," the German anti-virus company. In addition, users advised to not open email attachments from unknown senders and no macros enable foreign documents.

Researcher Bypasses Windows UAC New Trick

Windows User Account Control (UAC) is a security measure in accordance with Microsoft to protect computers from "hackers and malicious software," but through a new trick to get around, as demonstrated by security researcher Cylance.

As software or a user wants to change some Windows settings or try to perform actions that require administrative privileges displays a UAC warning. Only when the user gives permission, the action will also be performed. In case the user does not have administrator rights, he must first enter the administrator password before the action is performed.

ShameOnUAC

Researcher Derek Soeder developed malware to attack it in Windows Explorer. The malware, Soeder "ShameOnUAC", and injects itself into the Explorer process which does not have administrator rights. Then watch this process until the user wants to start a program as an administrator. The application of this program to the administrator rights is manipulated by malware and provide any additional commands. For example, commands can through the command prompt in Windows are executed or made ​​changes to the Windows Registry.

Soeder explains that in case the user starts cmd.exe and then accept the UAC warning ShameOnUAC can first run a command with administrator rights before the user gets to see the command prompt. The attack is easy to prevent, users must namely "Show details" click in the UAC warning. The added jobs are namely displayed. However, it is up to the user to do so every time.

"It is important to note that UAC works just referred to. ShameOnUAC is eerie to see in action, because it shows that every user already malware inadvertently elevated privileges have been able to give that was the end of practice, the information by any time ignoring that they could observe it, "says the researcher. In the event malware administrative rights on a computer can get because attackers can take complete control over the system. Soeder himself says that he is always present after his research examines the details of a UAC warning.

Researchers Bypass Windows Security With 1 Bit

A group of researchers has managed to overcome all sorts of important security controls in Windows by changing only one bit. The problem in Windows Kernel played until yesterday evening in all supported Windows versions, including the technical preview of Windows 10.

Microsoft has over the years provided the Windows kernel of all additional protective measures to make it more difficult for an attacker to present a possible leak actually exploit. This involves things like Kernel DEP KASLR, SMEP and NULL dereference Protection. The researchers discovered that the leak made it possible for an attacker who had access to the system to bypass all Windows Security.

The exploit that researchers enSilo developed requirement only adjusting one bit to abuse of the leak. The problem a few months ago was reported to Microsoft, which last night in the form of Security Bulletin MS15-010 came with an update.Through the leak, which in this film is demonstrated, an attacker could raise its rights on the system, according to the description of Microsoft.

The researchers say they have shown that even a small bug can give full control over Windows. "Nevertheless, we find that Microsoft's efforts to secure the operating system have raised the bar properly and making reliable exploits have made much more difficult than before." Yet they say that these measures will not keep attackers at bay and that will add this kind of exploits eventually to their arsenal.