Windows Security Architecture Study Notes

Architecture

Kernel mode vs. User mode

Security components in user mode:

  • Logon process (WinLogon): Manages user logon sessions.

  • Local Security Authority (LSA): Responsible for enforcing security policies on the system and handles user authentication.

  • Security Account Manager (SAM): Manages user accounts and passwords in Windows.

Security components in kernel mode:

  • Security Reference Monitor: Ensures access control.

  • Device drivers: Typically run in kernel mode, managing hardware without user intervention.

Applications

User-Mode and Kernel-Mode Drivers

  • User-Mode Drivers: Execute in user mode, enabling applications to communicate with hardware without direct access to kernel mode.

  • Kernel-Mode Drivers: Located in the kernel mode, interacting directly with hardware components and the operating system kernel.

System Architecture Overview

  • Operating System Kernel: The core component managing system resources, mediating access to hardware, and facilitating communication between user applications and hardware.

  • Hardware Abstraction Layer: Provides a uniform interface for interacting with different hardware devices, shielding applications from hardware variations.


Diagram of Architecture

Security Components

Important Security Processes

  • Lsass: Local Security Authority Subsystem Service, responsible for enforcing the security policy.

  • Winlogon: Handles user logon and logoff procedures.

  • Netlogon: Facilitates communication between workstations and domain controllers, vital in a domain environment.

  • Active Directory: The directory service for Windows domain networks.

  • LogonUI: User interface for logging in.

Security Libraries and Components

  • Msv1_0.dll: Windows authentication library.

  • Kerberos.dll: Implements the Kerberos authentication protocol used for secure communication.

  • LSA Policy: Controls the local security policy settings.

  • SAM Server: Manages local user accounts and security aspects.

User Login and Session Management

User Login Process

  1. Winlogon Process: Runs continuously as SYSTEM, awaiting user input.

  2. CTRL+ALT+DEL: This combination communicates securely with the Winlogon process, preventing interception by malware.

  3. Credential Submission: The Winlogon process captures the user's credentials and forwards them to the LSA.

  4. LSA Validation: LSA (lsass.exe) checks the credentials against the user's password stored in SAM for local accounts.

  5. Session Creation: Upon successful validation, a shell process (explorer.exe) is initiated in a new logon session for the user.

  6. Logoff Procedure: When the user logs off, the entire session and all associated processes are terminated.


Windows Registry

Structure and Purpose

  • Low-level Settings: The registry stores critical settings for the Windows OS and applications, structured hierarchically.

  • Keys and Values: Contains keys (which can have subkeys) and values that data needs for system configurations.

Specific Root Keys

  • HKEYLOCALMACHINE: Holds configuration data for the local machine, with restricted access.

  • HKEYCURRENTUSER: Contains settings specific to the current user, generally having less restricted access.

  • HKEYCURRENTCONFIG: Provides runtime information not typically stored on disk.

Storage of the Registry

  • The registry comprises multiple files known as hives, and some data may not reside on the disk.

Security Relevant Registry Hives

Key Hives in Windows

  1. HKEYLOCALMACHINE\SAM: Contains hashed passwords for user accounts.

  2. HKEYLOCALMACHINE\Security: Stores security policies and user rights.

  3. HKEYLOCALMACHINE\Software: Holds non-critical but frequently accessed data.

Accessing the Registry

  • Command to open regedit as SYSTEM using Psexec.exe:

    • psexec.exe –s –i regedit.exe

    • Psexec is part of the SysInternals suite.

User Password Storage in Windows

Storage Locations

  • Passwords Stored in SAM: Found under the registry path HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users.

  • Filename on Disk: Located at C:\Windows\System32\config.

Hash Extraction Methods

  • Access during running: SAM is inaccessible while Windows is operational, necessitating booting from an external Linux USB or CD to access the file.

  • Registry Extraction: Admin users can extract hashes using tools designed for registry access or manually interpret registry formats.

Password Hashing in Windows

LM Hash

  • Characteristics of LM Hash:

    • An insecure, outdated hash method.

    • Converts passwords to a maximum of 14 characters, uppercase, and divides into two 7-character parts.

    • Each part serves as a DES key for encrypting the static string "KGS!@#$%".

Source: Wikipedia - LM Hashing

NTLM Hash

  • Identification:

    • Uses MD4 hashing of the little-endian UTF-16 encoded password.

    • More secure than LM hash, but vulnerabilities exist when LM hashes are also stored.

Reasons for Cracking Passwords

  • Password reuse: Accessing credentials may provide entry to other resources.

  • File Access: With escalated privileges, users access sensitive files or configurations.

  • Gradual escalation of privileges leads to further system access capabilities.

Windows Domains

Domain Structure

a. Centralized Administration: Windows domains enable efficient, centralized security management, contrasting standalone local administration that does not scale well.

b. Domain Controllers (DC): At least one server designated to manage domain users and groups effectively, allowing admins to set security policies across multiple computers.

Active Directory Functionality

Core Functions of Active Directory

  • Authenticates users and computers within the domain network.

  • Authorizes user actions and enforces defined security policies.

  • Facilitates software deployment and updates across the network.

Access Control in Windows

Access Control Mechanisms

  • Enforces operational security policies, including definitions of who can perform specific actions.

Principal and Object Definitions

  1. Principal: The active entity (user or system process) requesting resource access.

  2. Object: The resource being accessed (file, directory, etc.).

  3. Decision Authority: Access can be granted or denied based on defined policies.

Principles of Access Control

Definition of Principals

  • Active entries in security policies can include users, groups, and machines.

  • Each principal is represented by a human-readable username and a machine-readable security identifier (SID).

Types of Principals

  1. Local Users: Specific to the machine.

  2. Domain Users: Recognized across the domain.

  3. Universal Principals: Such as the 'Everyone' group.

Security Identifier (SID) Structure

SID Format

  • The SID maintains a structure: S-R-I-SA-N, in which:

    • S = 'S' (indicates it's a SID).

    • R = Revision number (currently 1).

    • I = Identifier authority value:

    • 2 = Local

    • 3 = Creator

    • 5 = NT

    • SA = Sub-authority identifier, designating the specific domain or local identifier.

    • N = Relative identifier, unique within that authority.

Example SIDs

  • S-1-1-0: Everyone

  • S-1-5--500: Administrator

  • S-1-5--501: Guest

  • S-1-5--512: Domain Admins

Usage of SIDs

  1. Identifies the owner of an object in security descriptors.

  2. Specifies trustees in access control entries (ACEs) to manage permissions.

  3. Included in access tokens, defining user and group memberships.

Subjects in Windows Security

Definitions

  • Subjects: Active entities like processes or threads within the operating system.

  • Security Credentials: Stored in access tokens.

  • Inheritance: Newly spawned processes inherit the parent's security token unless restricted.

Access Token Contents

Components of an Access Token

  • User SID: Distinguishes the user.

  • Group SIDs: Lists the user’s group memberships.

  • Alias SIDs: Includes additional roles or group identifiers.

  • Privileges: Grants specific rights to the user/group.

Objects in Windows Security

Types of Security Objects

  1. File System Objects: Files and directories.

  2. Executive Objects: Processes and threads.

  3. Registry Keys: For configuration settings.

  4. Active Directory Objects: Instances managed in a directory service.

Security Descriptors and Permission Management

Security Descriptor Components

  • Owner SID: Identifies the object's owner.

  • Primary Group SID: Defines the object's primary group.

  • Discretionary Access Control List (DACL): Specifies which users/groups have access to the object and what level of access is permitted.

  • System Access Control List (SACL): Records access attempts and auditing entries.

Access Control Entries (ACEs) in DACL

  • Access Rights Mask: Determines the type of access.

  • Entry Type: Positive (access allowed) or negative (access denied).

  • Principal SID: Specifies the affected party in the ACE.

Permissions and Control Decisions

Definition of Permissions

  • Permissions detail the actions principals may execute on objects, including read, write, and execute rights.

Access Control Decision Factors

  1. Subject: Who is requesting access.

  2. Object: What access is requested.

  3. Desired Access: Type of operation intended.

  4. Outcome: Access grants if permissions align, denied if conflicting entries exist.

Null DACL vs Empty DACL

Difference Explained

  • Empty DACL: No access granted to any principal.

  • Null DACL: Universal access granted to all principals.

Access Control Example

Scenario: Access Control with Multiple Threads

  • Thread A and Thread B request access to an object with a complex ACL. DACL entries determine permissions granted or denied based on the authenticated identities.

Mandatory Integrity Control (MIC)

Functionality and Implementation

  • MIC: A supplementary access control mechanism that evaluates access based on integrity levels and policies.

  • Integrity Levels: Assigns a security level to both principals and objects, akin to military clearance levels.

Representation of Integrity Levels

  • Integrity labels represented by integrity SIDs. Objects without a specific SID default to medium integrity.

Summary of User Account Control (UAC)

User Account Control Principles

  • Promotes security by ensuring users operate with the lowest necessary privileges.

  • Requires admin credential prompts when necessary, enabling a balance between user convenience and security.

Access Token Models with UAC

  • Two access tokens for administrator users: a standard and an elevated token, providing necessary flexibility without compromising security.

Windows Security Enhancements

Mitigation Improvements

  • Strategies implemented to mitigate vulnerabilities include:

    • Removing classes of vulnerabilities.

    • Disabling exploitation techniques.

    • Preventing persistence of attacks.

    • Limiting exploitation windows.