SoylentNews is people
SoylentNews
Malware authors have a new UAC bypass technique at their disposal that they can use to install malicious apps on devices running Windows 10.
Responsible for discovering this new UAC bypass method is a German student that goes online by the name of Christian B., currently working on his master's thesis, centered on UAC bypass techniques.
The technique he came up with is a variation on another Windows 10 UAC bypass method discovered by security researcher Matt Nelson in August 2016.
While Nelson's method used the built-in Event Viewer utility (eventvwr.exe), Christian's UAC bypass uses the fodhelper.exe file, located at:
C:\Windows\System32\fodhelper.exe
If this file name isn't familiar to you, this is the window that appears when you press the "Manage optional features" option in the "Apps & features" Windows Settings screen.
Both techniques work in the same way and take advantage of what's called "auto-elevation," which is a state that Microsoft assigns to trusted binaries (files signed with Microsoft certificate, and located in trusted locations such as "C:\Windows\System32").
Just like eventvwr.exe, fodhelper.exe is also a trusted binary, meaning Windows 10 won't show a UAC window when launched into execution, or when other processes spawn from the fodhelper.exe parent process.
The technique employs changing the value of a registry key to contain the command to be executed. Since fodhelper.exe is trusted, the command is executed without the UAC prompt. The article continues with how to avoid the exploit. First off, do NOT run as an Administrator by default. Second, set the UAC level to "Always notify."
(Score: 2, Insightful) by Anonymous Coward on Friday May 26 2017, @12:07AM (6 children)
Um, what?? Bypassing security features of proprietary operating systems, I did in grade school. I did it for fun and I got no credit for it from anyone. If this jerk deserves a master's degree for kids' stuff, I demand ten doctorates. Right now. Give. Keep them coming. I'm feeling another idea coming out.
(Score: -1, Flamebait) by Anonymous Coward on Friday May 26 2017, @12:29AM
You fucked around with kid's stuff before malware became big business. There's a shitton of money in malware research but not for bitter old washed up whiners like you. You're just not valuable. Kill yourself.
(Score: 0) by Anonymous Coward on Friday May 26 2017, @02:53AM (1 child)
Did you document it and write a paper up on it then defend it or just brag about it?
Sometimes once the work is done the bullshit has just begun. You did the 'fun' part then skipped the showing why it works part...
(Score: 0) by Anonymous Coward on Friday May 26 2017, @03:20PM
Or showing that it actually works.
(Score: 4, Insightful) by canopic jug on Friday May 26 2017, @04:55AM
Money is not free speech. Elections should not be auctions.
(Score: 0) by Anonymous Coward on Friday May 26 2017, @06:14AM (1 child)
Everybody has a degree today, so degrees are worthless because they represent nothing.
(Score: 4, Interesting) by canopic jug on Friday May 26 2017, @09:36AM
They are also worth nothing because they contain nothing. That situation now extends especially to Computer Science degrees.
As degree programmes fall to M$, they start churning out fools that know nothing except how to resell M$ products. This has been going on long enough that they are feeding back into the system and replacing faculty members, creating a downward spiral. Each year that goes by, there are fewer people left than know about computers and fewer that can do anything advanced. In a generation or two, real generations not academic generations, we'll be in a situation were we have mostly information communication technologies that completely fail to perform. Of those few that still work, no one will know how to maintain them let alone how to change or improve them.
Money is not free speech. Elections should not be auctions.