Re:Windows Defender Antivirus and layered machine learning d...
by ksk on Wednesday December 13, 2017 @06:58PM
(#15918838)
>Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges?
Sure, just dump the security token for MsMpEng.exe. Here it is: https://pastebin.com/ukMPUWA7
IntegrityLevelIndex is 01, MandatoryPolicy is 0x3 , Privs are a subset of the full list.
https://www.nirsoft.net/kernel_struct/vista/TOKEN.html
https://msdn.microsoft.com/en-us/library/windows/desktop/bb5...
https://msdn.microsoft.com/en-us/library/windows/desktop/bb3...
Certain parts of an AV product need to run with the top-most privileges. But that component should be relatively lean, and quickly hand off dangerous work to lower-privilege, memory isolated, processes.
Windows Defender has a process called NScript which is a full JavaScript processing engine, running in SYSTEM. A JavaScript engine is inherently complicated enough to have bugs, and running as SYSTEM with no isolation could allow escalating a bug into a full blown code execution just by visiting a web page. None of this is theoretical, it was found and exploited May 2017 [0].
You're correct in saying that Windows does allow more nuanced token control than the full user's context, but I'm yet to read that Windows Defender actually utilises that. None of the previous bugs have been stopped by low-priv style access control, it has been a full SYSTEM leak. Do you have specific information about Windows Defender which suggests they're using voluntary revocation of token privileges?
[0] https://bugs.chromium.org/p/project-zero/issues/detail?id=12...