Free Newsletter
Register for our Free Newsletters
Access Control
Deutsche Zone (German Zone)
Education, Training and Professional Services
Government Programmes
Guarding, Equipment and Enforcement
Industrial Computing Security
IT Security
Physical Security
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec

Password privilege exploit on Windows operating systems

CyberArk Software : 15 January, 2008  (Technical Article)
Flaw in Windows local procedure call enabling users to increase privileges has now been patched by Microsoft.
Cyber-Ark has warned companies to be on their guard against a potentially serious password security issue on the Windows 2000, XP and 20003 server operating system platforms.

'The security flaw, discovered by SkyRecon, centres on the Windows Local Procedure Call interface, and is similar to the problems exploited by the Sasser worm back in 2004,' said Calum Macleod, Cyber-Ark's European director.

According to Macleod, elevated password privilege flaws are nothing new and actually date back to the 1980s on networked and distributed computer systems of that era.

'There was a relatively famous security flaw on the DEC 10 computer systems in the mid-1980s that allow users and/or their programs to hop between different IDs and elevate their user privileges on an incremental basis,' said Macleod.

'Fortunately for DEC 10 system managers, most of whom where in the education sector, the flaw was exploited by hackers to allow them to use extra system resources to play multi-user games during office hours, rather than anything malicious,' he added.

Macleod went on to say that this latest security flaw, which Microsoft has patched, exploits a loophole in the Local Security Authority Subsystem Service process, which is normally used to manage user privileges within Windows.

'As such it allows hackers to escalate their levels of system access, just as their counterparts did in the mid-1980s, but hackerdom has changed immensely in the last two decades, with criminals now pulling the strings,' he said.

'As a result, it is imperative that IT managers keep their security software bang up to date, as well as review the degree of protection they afford their databases,' he added
Bookmark and Share
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
   © 2012
Netgains Logo