Start Menu - Windows 'Heel' of Windows Vista

The Start Menu is Windows Vista's 'heel', which stores all the keys to access the Vista 'castle'. The conclusion was Robert Paveza, an online marketing application developer Terralever.

Paveza is also the author of a two-stage attack method designed to attack Windows Vista by exploiting weaknesses in User Account Control and virtual interface support devices (shells). ) of the operating system.

This attack is mainly based on 'social engineering' techniques, a trick used by many hackers for access to networks, computers, to 'drop' a Trojan program into the system. The first phase focuses mainly on the process of interacting with users and disposing of tools through the proxy, a process that does not require administrative privileges. The basic task of a proxy infection tool, or Trojan, is to open a real attack phase to harm Windows Vista.

' The Start Menu interface, as well as the desktop and any other part of the user directory structure, can potentially be exploited for users. As you can see, in all user folders - including Desktop, Start menu sections, Documents, Music, Video, Application Data folders - each folder can be written by the user who owns it.

In addition, Start Menu aggregates All users (all users) and Start Menu folders of a specific user to be combined, along with the user's priority folder, to create a mixed Start Menu that is displayed. by the shell utility ', Paveza describes.

The tool spreads through proxies, or Trojans, which will replace shortcuts from the Start Menu desktop and folder in a manner similar to the way viruses are attached. ' User-controlled proxy tool, will write to the user's Start Menu folder and read from the global Start Menu folder without requiring advanced permissions. The program will find on the global Start menu folder all the programs that require advanced and create copies in the user directory indicating malicious code , 'said Ron Bowes, a researcher with Symantec security. said.

All this malicious program has to do now is wait for the user to run one of the "malformed" copies of the genuine original programs on the Windows Vista machine through the Start Menu or the desktop. Only now will the user be presented with a User Account Control privilege request, but because the original programs are 'genuine', administrative privileges will be recognized immediately, thus that attack damage to the operating system is complete.

Nguyen Nam