Preventing Rogue Services with Windows Service Hardening

written by: Pablo Martinez; article published: year 2007, month 04;

In: Root » » Windows

  Share  
|
  PL  |  NL  |  FR  |  ES  |  PT  |  IT  |  DE  |  DK  |  NO  |  SE  |  FI  |  GR  |  JP  |  CN  |  KR  |  RU  |  AE


If you could map out the Windows attack surface, the biggest feature in the resulting landscape would be, by far, the system and third-party services that run in the background. Services are a tempting malware target for two reasons. First, most services are "always on," in the sense that they start when Windows loads and then remain running until you shut down the system. Second, most services run with a high privilege level that gives them full access to the system. Malware that manages to get into a computer can use the system services to perform almost any task, from installing a Trojan horse to formatting the hard drive.

To reduce the chance that a malware program could turn a system's services on itself, Windows Vista implements a new service security technology called Windows Service Hardening. This technology doesn't prevent malware from infecting a service. (That's the job of Windows Firewall and Windows Defender.) Instead, Windows Service Hardening is designed to limit the damage that a compromised service can wreak upon a system by implementing the following security techniques:

  • All services run in a lower privilege level.

  • All services have been stripped of permissions that they don't require.

  • All services are assigned a security identifier (SID) that uniquely identifies each service. This enables a system resource to create its own access control list (ACL) that specifies exactly which SIDs can access the resource. If a service that's not on the ACL tries to access the resource, Vista blocks the service.

  • A system resource can restrict which services are allowed write permission to the resource.

  • All services come with network restrictions that prevent services from accessing the network in ways not defined by the service's normal operating parameters.

Share

Disclaimer

1) E-articles is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringement, please read the terms of service and contact us or use the "Report this article" button on this page to investigate the problem.
2) E-articles is not responsible for inaccuracies, falsehoods, or any other types of misinformation this article may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here.