Privilege escalation explained

Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application or user with more privileges than intended by the application developer or system administrator can perform unauthorized actions.

Background

Most computer systems are designed for use with multiple user accounts, each of which has abilities known as privileges. Common privileges include viewing and editing files or modifying system files.

Privilege escalation means users receive privileges they are not entitled to. These privileges can be used to delete files, view private information, or install unwanted programs such as viruses. It usually occurs when a system has a bug that allows security to be bypassed or, alternatively, has flawed design assumptions about how it will be used. Privilege escalation occurs in two forms:

Vertical

This type of privilege escalation occurs when the user or process is able to obtain a higher level of access than an administrator or system developer intended, possibly by performing kernel-level operations.

Examples

In some cases, a high-privilege application assumes that it would only be provided with input matching its interface specification, thus doesn't validate this input. Then, an attacker may be able to exploit this assumption, in order to run unauthorized code with the application's privileges:

Jailbreaking

In computer security, jailbreaking is defined as the act of removing limitations that a vendor attempted to hard-code into its software or services.[2] A common example is the use of toolsets to break out of a chroot or jail in UNIX-like operating systems[3] or bypassing digital rights management (DRM). In the former case, it allows the user to see files outside of the filesystem that the administrator intends to make available to the application or user in question. In the context of DRM, this allows the user to run arbitrarily defined code on devices with DRM as well as break out of chroot-like restrictions. The term originated with the iPhone/iOS jailbreaking community and has also been used as a term for PlayStation Portable hacking; these devices have repeatedly been subject to jailbreaks, allowing the execution of arbitrary code, and sometimes have had those jailbreaks disabled by vendor updates.

iOS systems including the iPhone, iPad, and iPod Touch have been subject to iOS jailbreaking efforts since they were released, and continuing with each firmware update.[4] iOS jailbreaking tools include the option to install package frontends such as Cydia and Installer.app, third-party alternatives to the App Store, as a way to find and install system tweaks and binaries. To prevent iOS jailbreaking, Apple has made the device boot ROM execute checks for SHSH blobs in order to disallow uploads of custom kernels and prevent software downgrades to earlier, jailbreakable firmware. In an "untethered" jailbreak, the iBoot environment is changed to execute a boot ROM exploit and allow submission of a patched low level bootloader or hack the kernel to submit the jailbroken kernel after the SHSH check.

A similar method of jailbreaking exists for S60 Platform smartphones, where utilities such as HelloOX allow the execution of unsigned code and full access to system files.[5] [6] or edited firmware (similar to the M33 hacked firmware used for the PlayStation Portable)[7] to circumvent restrictions on unsigned code. Nokia has since issued updates to curb unauthorized jailbreaking, in a manner similar to Apple.

In the case of gaming consoles, jailbreaking is often used to execute homebrew games. In 2011, Sony, with assistance from law firm Kilpatrick Stockton, sued 21-year-old George Hotz and associates of the group fail0verflow for jailbreaking the PlayStation 3 (see Sony Computer Entertainment America v. George Hotz and PlayStation Jailbreak).

Jailbreaking can also occur in systems and software that use generative artificial intelligence models, such as ChatGPT. In jailbreaking attacks on artificial intelligence systems, users are able to manipulate the model to behave differently than it was programmed, making it possible to reveal information about how the model was instructed and induce it to respond in an anomalous or harmful way.[8] [9]

Android

See main article: Rooting (Android). Android phones can be officially rooted by either going through manufacturers controlled process, using an exploit to gain root, or flashing custom recovery. Manufacturers allow rooting through a process they control, while some allow the phone to be rooted simply by pressing specific key combinations at boot time, or by other self-administered methods. Using a manufacturers method almost always factory resets the device, making rooting useless to people who want to view the data, and also voids the warranty permanently, even if the device is derooted and reflashed. Software exploits commonly either target a root-level process that is accessible to the user, by using an exploit specific to the phone's kernel, or using a known Android exploit that has been patched in newer versions; by not upgrading the phone, or intentionally downgrading the version.

Mitigation strategies

Operating systems and users can use the following strategies to reduce the risk of privilege escalation:

Recent research has shown what can effectively provide protection against privilege escalation attacks. These include the proposal of the additional kernel observer (AKO), which specifically prevents attacks focused on OS vulnerabilities. Research shows that AKO is in fact effective against privilege escalation attacks.[12]

Horizontal

Horizontal privilege escalation occurs when an application allows the attacker to gain access to resources which normally would have been protected from an application or user. The result is that the application performs actions with the same user but different security context than intended by the application developer or system administrator; this is effectively a limited form of privilege escalation (specifically, the unauthorized assumption of the capability of impersonating other users). Compared to the vertical privilege escalation, horizontal requires no upgrading the privilege of accounts. It often relies on the bugs in the system.[13]

Examples

This problem often occurs in web applications. Consider the following example:

This malicious activity may be possible due to common web application weaknesses or vulnerabilities.

Potential web application vulnerabilities or situations that may lead to this condition include:

See also

Notes and References

  1. Web site: Taimur Asad. Apple Acknowledges iOS 4.1 Security Flaw. Will Fix it in November with iOS 4.2. RedmondPie. October 27, 2010. November 5, 2010. February 18, 2013. https://web.archive.org/web/20130218041359/http://www.redmondpie.com/ios-4.2-to-fix-ios-4.1-lockscreen-security-flaw/. live.
  2. Web site: Definition of JAILBREAK . www.merriam-webster.com . 24 December 2022 . en . 24 December 2022 . https://web.archive.org/web/20221224032452/https://www.merriam-webster.com/dictionary/jailbreak . live .
  3. Book: Cyrus Peikari. Anton Chuvakin. Security Warrior: Know Your Enemy. registration. 2004. "O'Reilly Media, Inc.". 978-0-596-55239-8. 304.
  4. Web site: Reports: Next iPhone update will break third-party apps, bust unlocks ]. Computerworld on v1.1.3 . 2008-01-01 . 2008-01-04 . https://web.archive.org/web/20080104084911/http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyId=11&articleId=9054719&intsrc=hm_topic . dead .
  5. Web site: Announcement: Forum down for maintaining . Phat^Trance . Feb 16, 2010 . dailymobile.se . August 30, 2016 . Just wanted to let you guys know that the forum is down for maintaining. It will be back online in a day or so (i kinda messed up the config files and need to restore one day old backup, so i thought why not update the entire server platform) . dead . https://web.archive.org/web/20090303164625/http://dailymobile.se/forum/index.php?topic=1165.0 . March 3, 2009 .
  6. Web site: HelloOX 1.03: one step hack for Symbian S60 3rd ed. phones, and for Nokia 5800 XpressMusic too . 2009-07-06 . 2020-08-07 . https://web.archive.org/web/20200807174842/http://symbianism.blogspot.com/2009/02/helloox-103-one-step-hack-for-symbian.html . live .
  7. Web site: Bypass Symbian Signed & Install UnSigned SISX/J2ME Midlets on Nokia S60 v3 with Full System Permissions . 2009-07-06 . 2016-09-11 . https://web.archive.org/web/20160911140221/http://thinkabdul.com/2007/10/29/tutorial-bypass-symbian-signed-install-unsigned-sisxj2me-midlets-on-nokia-s60-v3-with-full-system-permissions/ . live .
  8. Web site: What is Jailbreaking in A.I. models like ChatGPT? . 2023-11-01 . 2023-12-01 . https://web.archive.org/web/20231201033428/https://www.techopedia.com/what-is-jailbreaking-in-ai-models-like-chatgpt . live .
  9. Web site: ChatGPT’s ‘jailbreak’ tries to make the A.I. break its own rules, or die . 2023-11-01 . 2023-03-02 . https://web.archive.org/web/20230302105502/https://www.cnbc.com/2023/02/06/chatgpt-jailbreak-forces-it-to-break-its-own-rules.html . live .
  10. Web site: Microsoft Minimizes Threat of Buffer Overruns, Builds Trustworthy Applications. Microsoft. September 2005. 2008-08-04.
  11. Web site: Smalley. Stephen. Laying a Secure Foundation for Mobile Devices. 7 March 2014. 28 August 2017. https://web.archive.org/web/20170828232658/http://www.internetsociety.org/sites/default/files/Presentation_Smalley.pdf. dead.
  12. Yamauchi . Toshihiro . Akao . Yohei . Yoshitani . Ryota . Nakamura . Yuichi . Hashimoto . Masaki . August 2021 . Additional kernel observer: privilege escalation attack prevention mechanism focusing on system call privilege changes . International Journal of Information Security . en . 20 . 4 . 461–473 . 10.1007/s10207-020-00514-7 . 1615-5262 . free . 2023-11-10 . 2024-05-24 . https://web.archive.org/web/20240524180458/https://link.springer.com/article/10.1007/s10207-020-00514-7 . live .
  13. Book: Diogenes, Yuri . Cybersecurity - Attack and Defense Strategies - Second Edition . 2019 . Erdal Ozkaya, Safari Books Online . 978-1-83882-779-3 . 2nd . 304 . 1139764053 . 2022-08-13 . 2024-05-24 . https://web.archive.org/web/20240524180523/https://search.worldcat.org/title/1139764053 . live .