January 31, 2006

Windows Access Control Demystified

I just came across an interesting paper being published out of Princton in which the authors have constructed a logical model of Windows XP access control, in a declarative but executable format.

They have even built a simple scanner that reads access-control conguration information from the Windows registry, file system, and service control manager database, and feeds raw configuration data to the model. Through this, they believe they can reason about such things as the existence of privilege-escalation attacks, and they believe that they have even found several user-to-administrator vulnerabilities caused by misconfiguration of the access-control lists of commercial software from several major vendors.

It is an interesting approach. I will need to spend a bit more time analyzing what they have done here in an effort to see what it is that they believe they are able to do. It seems that this might be an interesting way to to model and debug the complex interactions of access control on installations under Windows environments.

Their words... not mine. Interesting none the less. Happy reading!

Posted by SilverStr at January 31, 2006 05:40 PM | TrackBack
Comments

Hello Dana,

I see you have a blog where you talk about different web technologies, I thought you might be interested in a new search engine called Dumbfind. Dumbfind automatically tags the web and allows you to search on both keywords and tags. Dumbfind will also display related tag clusters in a tag cloud format that you can use to refine a search. It is a new and interesting way to search, please check it out!

www.dumbfind.com

Dumbfind in the press www.dumbfind.com/corp/press

If you have any feedback, you can send it directly to the CEO: info@dumbfind.com

thanks!

KT
PR Intern
Dumbfind Inc

Posted by: KT at February 1, 2006 03:57 PM

I think you mean Princeton, not Princton. :) I always wanted to know how to exploit Power User access so you can elevate yourself to an Administrator. All the old tricks using the AT command don't seem to work in SP2 unless I'm doing something wrong.

It would be nice to exploit this to show people why giving Power User access to regular users is a really bad idea.

Adam

Posted by: Adam at February 1, 2006 06:43 PM