Before we go on to take a look at lower level boundaries.
Let's see how the user session boundary has been implemented in Windows 7.
We'll use this internal suite for this presentation since internals is a suite of tools developed by
Mark Russinovich.
The tools are probably well known to all administrators and to other Windows systems security practitioners
will run a program called Process Explorer
even though the program is contained in the Trusted directory.
Note that I still have to agree to run it
taking a look at the program's properties.
It turns out that the file is external.
It comes from another computer.
It's still blocked even though it's currently stored in my computer this information has been saved.
To disabled the open file security warning need to unblock the program by clicking on the button.
See above.
The question is Where does Windows Store this type of information.
It's saved in an alternate file stream on an NTFS drive.
Objects on NTFS drives can have multiple data streams
alternate data streams are used exactly for this purpose.
To store the origin of a file and allow a system to perceive it as a file that comes from an external
site.
Data streams may also be used to hide certain types of data coming back to our program.
Well run with the administrator privileges.
We'll later talk about the origin of the need to relaunch it and confirm the decision.
Let's take a look at the processes that run under the current account.
Our account the rows of these processes are by default highlighted in blue
the operating systems shell.
For example Windows Explorer is currently highlighted process
various processes are launched within this shell.
The bottom pane contains information on the selected Explorer process.
You can view for example the activity of the process.
In this case we can see the objects loaded by a given process.
As you can see a session has been set up for us.
Your identifier is one
were probably the first users who logged into this environment by right clicking on a process running
in our session.
You can select Properties.
Let's move to the Security tab.
Everything is tagged in such a way that the objects opened by a process can only be accessed by us.
The current user account a built in system account and a strange account with a visible seed
one Desch five Desch five Desch zero seed indicates a logging identifier in a way.
This is an additional identifier of the above user no other accounts can interfere or tamper with the
operation of the process except for the operating system itself.
We'll leave process explorer for a moment but will return to it later.
Well run now a standard Windows tool Windows Task Manager
wants all the user's processes are displayed and we sort them by user names.
It turns out that we can view our processes and the processes of other users.
This is possible because the program runs with Administrator permissions we have discovered first that
session defines a security boundary.
But here we can see that in an administrator account can cross this boundary.
It's enough to right click on let's say I Explorer easy to be able to end it which is an obvious interference
with the operation of the process
the administrator crosses the boundary in an explicit and apparent manner.
The last aspect of a user session boundary will cover is isolating session zero
to do this we'll need a program called PSA exam.
Let's start by launching the command line with the administrator permissions
next to the CIS internals folder
Yes exec is commonly used to launch processes on remote computers.
It can allow us to gain access to a remote operating system and the command line of that system.
One of the additional features offered by the tool enables running it in a different session after submitting
sessions number this is enabled by the and size switch.
Let's find out how it works.
Let's run any program for example Kalki X-C in-session 0
calculator is running but we don't see it on our screen
the isolation of the session is working.
There's a new warning in the taskbar a program running on our computers trying to display a message
but we can't view it the window appeared because session zero isolation is a feature that can only be
implemented beginning with Windows 7.
It wasn't available in the previous versions all services were running before in the context of the
session of a user who logged in first
the session encompases also anti-virus scanners which are programs that run a system services
any viruses interact with users display messages warnings etc..
After the release of Windows 7 and the virus is shut down to allow them to work.
Microsoft introduced the dialog box you can see above by clicking on view the message you switch in
a way to a different desktop.
You can see here the desktop of a user who launched session 0 or effectively the operating system.
Let's quit the program and return to our own session because session zero doesn't show any new messages.
The displayed window has also disappeared.