Microsoft obliquely acknowledges Windows 0-day bug published on Twitter

Here is the alpc bug as 0day: https://t.co/m1T3wDSvPX I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit.

- SandboxEscaper (@SandboxEscaper) August 27, 2018

A privilege escalation flaw in Windows 10 was disclosed earlier this week on Twitter. The flaw allows anyone with the ability to run code on a system to elevate their privileges to "SYSTEM" level, the level used by most parts of the operating system and the nearest thing that Windows has to an all-powerful superuser. This kind of privilege escalation flaw enables attackers to break out of sandboxes and unprivileged user accounts so they can more thoroughly compromise the operating system.

Microsoft has not exactly acknowledged the flaw exists; instead it offered a vague and generic statement: "Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is to provide solutions via our current Update Tuesday schedule." So, if the flaw is acknowledged (and it's certainly real!) then the company will most likely fix it in a regular update released on the second Tuesday of each month.

The tweet links to a GitHub repository that contains a write-up of the issue and demonstration code to exploit the flaw. The bug lies in the Task Scheduler service: it includes an improperly secured API that allows an attacker to overwrite most files on the system with contents of their choosing. By overwriting a file that's subsequently loaded into a privileged SYSTEM-level process, the attacker can run code of their choosing with SYSTEM privileges. The proof of concept overwrites a file used by Windows' printing subsystem-Windows will then run the attacker's code when an attempt is made to print.

Read 1 remaining paragraphs | Comments