Windows 10 Privilege Escalation via Dolby's DAX2_API Service

http://x42.obscurechannel.com/?p=263

by x42 • 10 years ago

88 23 10 years ago

x42.obscurechannel.com

frik• 10 years ago

"System" is the highest privilege, like "root" on Linux.

Not necessarily in Windows 10 Enterprise, there can be some limits to what "System" can access, with a feature designed to protect credentials from exploited drivers:

With Windows 10 and Device Guard, credentials are stored encrypted using Hyper-V, an approach known as "virtualization-assisted security." Credential Guard blocks access "even when an untrusted program has full administrative access to your environment,"

Drivers can't get into the Local Security Authority of Windows 10

https://redmondmag.com/articles/2015/10/28/windows-10-creden...

creshal3• 10 years ago

So, System still has full access to ring 0, but some bits of the OS are moved into the hypervisor "ring -1"?

okasaki• 10 years ago

You can limit root on linux too with a MAC framework.

CrowFly2• 10 years ago

Is this "Dolby DAX2" a standard component? There's no trace of it on my stock Windows 10 Surface Book.

nbevans• 10 years ago

Nope. It's some crapware that IBM bundles.

Sanddancer• 10 years ago

IBM's not had anything to do with ThinkPads for a decade, and hasn't had any presence in even x86 servers since 2014.

pjmlp• 10 years ago

No, it is one of those OEM enhancements that get delivered with nice sound speakers.

rockdoe• 10 years ago

Let me rephrase that: "with crap speakers to make them seem less crap".

rasz_pl• 10 years ago

its value added BS. Dolby tries very hard to be Creative 2.0 by pushing patented crap into standards (hdmi, bluray) to position itself as essential for hi def audio = collect patent tax.

creshal3• 10 years ago

The ubiquity of DTS in the PC and hifi market is probably scaring the crap out of them.

akx• 10 years ago

So it's not even a vulnerability in the service's code, but in its metadata (file permissions).

Neat!

x42• 10 years ago

ships with Lenovo Thinkpads running windows 10 by default, possibly windows 8.

derFunk• 10 years ago

I can imagine it would be possible to reverse engineer the service interfaces of DolbyDAX2API.exe ("exported functions"), write a wrapper which embeds the original executable and forwards the service requests to the original implemententation. The wrapper could contain malicious code and intercept the service calls. This could be even done generically. Maybe something like this exists already anyway. This way nobody would notice that something is wrong - functionality wise. Perfect eavesdropping on Windows services.

roddux• 10 years ago

I was thinking this was where the article was going, but the solution ended up being a lot simpler. It leaves traces and notifies the user, though...

I suppose yet another way would be to make a copy of the executable before the overwrite, then restore it after gaining a stable SYSTEM shell.

libeclipse• 10 years ago

This is really an argument about whether or not proprietary systems are inherently more secure. I run Arch on my main system, and when a vulnerability is disclosed, it's often patched within hours. Windows is littered with bugs, vulnerabilities, and security holes. Older versions have been left to rot, leaving thousands of systems vulnerable.

Of course, it could be argued that the weakest link in the chain is the user, but with a vulnerability like this one, I don't see how that applies.

worewood• 10 years ago

In this case the "user" is the system manufacturer who developed an exploitable application, in this case, Lenovo.

Lenovo could sell a Linux PC with a similar application that communicated with a daemon running as root which binary was saved in /bin with 0777 permissions.

There is nothing special about Windows that makes this vulnerability possible.

The end user mistake here was buying Lenovo.

bizarref00l• 10 years ago

For things like this SELinux really comes in handy.

pixl97• 10 years ago

I really don't understand your argument here.

As per definition of vulnerability, this is something that many Linux systems have ran into in the past. When you get outside of mainline distributed programs you see vendor issues like this all the time. 777 is a thing in Linux and people/vendors do dumb crap with it all the time. Privilege escalation to root via bad file permissions is not an uncommon problem in Linux either.

The patch for this problem is easy enough too.

Right click > security > remove full access.

If this application is widely distributed enough Microsoft may very well push a fix for it. What we don't know here is how many computers are affected by this, it could be a very large number, or it could be a few from a limited distribution with a bad setting.

Windows 10 Privilege Escalation via Dolby's DAX2_API Service

Related Stories