Thwarting Integrity Attacks with Chml

Last month, in "Chml Fills the Gap" (InstantDoc ID 95973), I introduced you to Chml, a utility I created for exploiting the new Windows Vista integrity levels to potentially shore up your computer's security. You'll recall from my past two columns that integrity levels resemble file permissions—but they also override file permissions. In other words, if integrity levels deny you access to an object, you're denied access to that object even if you have Full Control permission on that object.

Last month, I wrote that integrity levels support a largelyundocumented but useful notion called no read up, whichdenies Read access to an object that holds a higher integritylevel than the process (e.g., Microsoft Internet Explorer—IE,Word) trying to read it. This month, I return to the morewell documented integrity-level feature called no write up,which blocks any lower-integrity process from modifying ahigher-integrity object. But I take the discussion a bit furtherby exploring how to assume the System integrity level.

You're Kidding!
Vista recognizes five levels of integrity: Untrusted, Low, Medium, High, and System. (Another, even higher level called Protected Process isn't accessible or in use, as far as I can see.) Standard users typically operate as Medium integrity, and administrative users operate as High integrity. Notice, however, that Windows recognizes an integrity level higher than the level that administrators enjoy: the System level.

When I first learned that Vista included an integrity levelabove that of administrators, I freaked out: "What!? Microsoft has placed things on my own Vista laptop that I can'tdelete?" Indeed, early versions of Vista kept administratorsfrom accidentally deleting system files by giving thosefiles the System integrity level. But when Vista beta testerscomplained that they couldn't delete items on their owncomputer, Microsoft removed the System integrity levelfrom the files in the Windows folder.

Nevertheless, the System integrity level still worries me. What if a malicious user figures out how to install malware on my system and grant it the System integrity level? I wouldn't even be able to delete that malware, despite the fact that the Administrators group has Full Control permissions on every folder on the computer. Would my only option be to simply wipe the hard disk clean and start over? Thankfully, no.

Triple Play
I've discovered three ways to run Chml with the System integrity level. The first way to run Chml with the System integrity level is to simply boot your system with a Windows Preinstallation Environment (PE) CD-ROM. When you run Windows PE, you're running in the context of the System account, and—not surprisingly—the System account runs with the System integrity level.

So, if you were to come across some malware installed at the System integrity level, you'd need only to boot the afflicted computer with Windows PE and use Chml to lower the malware's integrity level, as I demonstrated last month:

chml  -i:m 

After you lower the malware's integrity level to Medium,you can delete the malware. Of course, you'd need to addChml to the Windows PE disk to use this solution, becausethe tool isn't built into Windows PE. Alternatively, you couldjust run Chml from a USB drive.

The second way to run Chml with the System integrity level is to go to Sysinternals (http://www.sysinternals.com), download the latest version of Psexec (psexec.exe), and exploit its new Vista-compatible -s switch, which lets you run any command in the context of the System account. So, for example, if you have Chml in a folder called C:stuff and you want to lower the integrity level of a folder named C:malware, you'd type

psexec -s C:mystuffchml.exe C:malware -i:m 

The third way to run Chml with the System integrity level is to use the new Task Scheduler, whose command-line interface lets you run any application in the context of the System account. For example, you can type (all on one line)

schtasks /create /tn dochml /ru "nt authoritysystem"    /sc once /st 09:28 /tr "C:mystuffchml.exe   C:malware -i:m -b" 

In this command, the /create option creates a new task. The /tn dochml option names the task dochml. The /ru "nt authoritysystem" option instructs Task Scheduler to run the command in the context of the System account. The /sc once /st 09:28 portion of the command runs the task once, at 9:28. (Unfortunately, Schtasks doesn't support the option to "do it now," as the Task Scheduler GUI does.)

Paranoid Much?
Yes, worrying about malware with a System integrity level might seem the height of paranoia. However, you're now equipped to defeat that malware—should it appear.