{"id":102745,"date":"2019-08-01T07:00:00","date_gmt":"2019-08-01T14:00:00","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/oldnewthing\/?p=102745"},"modified":"2019-08-01T06:55:59","modified_gmt":"2019-08-01T13:55:59","slug":"20190801-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20190801-00\/?p=102745","title":{"rendered":"Not actually crossing the airtight hatchway: Applying per-user overrides"},"content":{"rendered":"

We receive a number of security vulnerability reports of the form “If I write the following value into the registry at HKEY_<\/code>CURRENT_<\/code>USER\\...<\/code>, then the next time the user does X, I can do bad thing Y.”<\/p>\n

The most common version of this is where the registry key is HKEY_<\/code>CURRENT_<\/code>USER\\<\/code>Software\\<\/code>Classes\\<\/code>CLSID\\<\/code>...<\/code>, because that permits you to override a system COM object with a custom COM object.<\/p>\n

The fallacy here is hiding behind the change of pronoun in the attack description: If I<\/b> write the following value into the registry, then the next time the user<\/b> does X, I<\/b> can do bad thing Y.<\/p>\n

In reality, I<\/b> and the user<\/b> are the same person!<\/p>\n

In order to write to the user’s registry, you need to be that user or an administrator. Of course, if you are an administrator, then you’re already on the other side of the airtight hatchway, and this entire exercise is pointless.<\/p>\n

That leaves the case where the attacker is the user. In other words, the attacker is attacking himself. This is not particularly interesting. It is not a security vulnerability that users can make their own lives miserable. They could start by, say, deleting all their files, then move on to sending profanity-laden email messages to their boss.<\/p>\n

As I noted, COM class registrations are a commonly-reported vector for this attack, sometimes even touted as a way to obtain elevation. But that doesn’t work because COM is careful not to use registrations from HKEY_<\/code>CURRENT_<\/code>USER<\/code> when running elevated. Only HKEY_<\/code>LOCAL_<\/code>MACHINE<\/code> registrations are consulted when elevated, and attacking those registry key require that you already be elevated, so you haven’t gained anything.<\/p>\n

Another place people report this type of false vulnerability is when they see that the HKEY_<\/code>CURRENT_<\/code>USER<\/code> registry keys are affecting the behavior of svchost.exe<\/code> processes. But you need to look more closely at which<\/i> svchost.exe<\/code> processes are affected. Windows supports services that run under the context of the logged-on user, rather than as a privileged account. These reports breathlessly report that they found a way to inject code into svchost.exe<\/code> via HKEY_<\/code>CURRENT_<\/code>USER<\/code> attacks, but they failed to observe that the svchost.exe<\/code> they attacked is running as the logged-on user. Again, all they did was attack their own process; there is no elevation of privilege.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

The user is merely attacking himself.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-102745","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"

The user is merely attacking himself.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/102745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=102745"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/102745\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=102745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=102745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=102745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}