Security boundaries start with a physical computer.
We've also covered the subsequent boundaries and operating system boundary and a user session boundary.
Let's try to discover if a process also sets another system security boundary.
What's the meaning of a process to begin with.
The system test manager uses the term incorrectly.
A process is a binary code saved to a file a part of the virtual memory address to a system encode metadata
are allocated to an executable code.
The metadata includes mostly handles that enables the process to communicate with external processes.
A process also involves a security context that describes it these elements constitute a process as
such returning to the task manager the process tab shows elements that are not actual processes.
What's more some launched by Neriah objects are contained here multiple times
modern operating systems including Windows.
Don't use a process to set a security boundary or process defines a reliability boundary and is managed
by an operating system that allocates CPQ and RAM to processes.
This means that a single process can read modify the data other processes work with in a way that is
uncontrolled by the system this occurs within a user session and we run an untrusted program or an untrusted
process in our session.
This implies that we practically lose control over not only the results of the program's operation but
over the entire session.
This is important security wise and will bring this up more than once later.
We need to trust that a launch program will work as described by its developer.
Otherwise we need to verify this on our own.
We can conclude that we shouldn't normally use the Administrator account because a process run with
administrator privileges can affect also other processes run by other users a process that is run in
this way it crosses the boundary of a user session
Watchguard is another technology we'll talk about.
This technology has been developed to prevent the installation of programs running in the kernel mode
these programs operate at low level and can directly access other system processes which means that
they are able to access computer resources indirectly
Watchguard is a security solution deployed in 64 bit systems the working principle behind this technology
looks as follows.
If patch code detects a modification of the system processes that is unsupported by Microsoft.
The system halts as a stop errors reported all the most important system processes and toe's kernel
X-C all the L-L id t ss d t and MSR are protected using patch card.
What's the purpose of this mechanism.
We're developing programs that run in kernel mode these programs include above all drivers and low level
services their creators or software manufacturers I guess viz many software manufacturers develop programs
that patch the kernel to make it compatible with their company's designs.
This meant that the programs made use of undocumented functions and features of the kernel what followed
is that any modification of these undocumented functionalities entailed the shutdown of a number of
programs used on the computer.
This practice resulted in Microsoft having their hands tied and an amendment or change in the system's
structure could bring about a failure of multiple programs and a round of disputes with ISV is about
making them work again.
To streamline this process the PESCHARDT technology has been implemented.
The solution report's critical errors which are signaled by the characteristic stop message this provides
a software developer with a clear sign that the program they are developing and testing uses an undocumented
functionality and patches the kernel in a way that is not supported by a system manufacturer.
These insured are the goals of patch card.
The goal was never to protect systems against malicious modifications of system processes.
Remember that you shouldn't base your security policy on solutions that weren't created with security
in mind this issue is all the more vital because the misconception is quite common.
This is why attacks occasionally target patch card as well.
Results of these attempts are later published and discussed at conferences.
It's been repeatedly proved that the technology can be successfully bypassed
Microsoft doesn't seem to react to these claims in any way.
The company doesn't treat bypassing patch card for example modifying a system process to your liking
and not following Microsoft recommendations as a security boundary violation.
So the vulnerabilities won't be patched in nor will any steps be taken to mitigate the threat.
The attacks are feasible and quite easy to run
Watchguard operates as a kernel process so it can't protect other processes that have similar level
of privileges.
The program doesn't protect files stored on the disk either.
The only objects that are protected are the process is loaded into memory.