Windows 10 UAC Bypass Uses Backup and Restore Utility

Bleeping Computer ^ | March 16, 2017 | Catalin Cimpanu

[Dalberg-Acton]

A new User Access Control (UAC) bypass technique relies on altering Windows registry app paths and using the Backup and Restore utility to load malicious code without any security warning.

The technique revolves around the notion of "auto-elevation," which is a state that Microsoft assigns to various trusted binaries.

For example, the Task Manager binary is an auto-elevated file because it's created and digitally signed by Microsoft, and is also housed in a trusted file location, under C:\Windows\system32.

This means that despite the UAC security level, launching Task Manager doesn't show a UAC window. Similarly, there are tens of other binaries that feature Auto-Elevation settings in their manifest files.

[Dalberg-Acton]

Ping to dayglored

[TChad]

This particular technique can be remediated or fixed by setting the UAC level to “Always Notify” or by removing the current user from the Local Administrators group.

How to set the UAC level:

https://www.tenforums.com/tutorials/3577-change-user-account-control-uac-settings-windows-10-a.html

[Garth Tater]

The CIA is starting to get really pissed about people exposing the methods they use to bypass Windows security. With the loss of this tool they’re now down to ~13,700 remaining hacks.

[AbolishCSEU]

please add me to your ping list please

[Dalberg-Acton]

Ping to dayglored, the keeper of the Windows list.

[dayglored]

Windows 10 UAC security bypass vuln ... PING!

You can find all the Windows Ping list threads with FR search: just search on keyword "windowspinglist".

Thanks to Dalberg-Acton for the ping!!

AbolishCSEU, LucyT: adding you to the list today. Welcome!

[upchuck]

Thanks for posting. From the article:

According to Nelson, this technique only works in Windows 10, and not earlier OS versions...

Another reason to stay with Windows 7.

[Stentor]

Another reason to stay with Windows 7.

Just re-installed Windows 7 for a friend after her 5 year old previous installation began to complain at start up. Chrome acted odd in the beginning, but is now working perfectly after hundreds of updates.

[Dalberg-Acton]

In my experience, Windows needs to be re-installed from scratch occasionally. It makes a huge difference in the performance.

[Ray76]

What a joke.