Skip to content
CYBER TALKS

Token Kidnapping's Revenge

Cesar Cerrudo

AppSecMain Stage55 minOpen on YouTube ↗

Cesar Cerrudo explores token kidnapping's revenge at DEF CON 18, examining database-security and practical defenses.

Summary

Architecture and Background

Cesar Cerrudo - Token Kidnapping's Revenge On April 14, 2009 Microsoft released a patch ( to fix the issues detailed in my previous Token Kidnapping presentation ( The patch properly fixed the issues but... This new presentation will detail new design mistakes and security issues that can be exploited to elevate privileges on all Windows versions including the brand new Windows 2008 R2 and Windows 7. These new attacks allow to bypass new Windows services protections such as Per service SID, Write restricted token, etc. It will be demonstrated that almost any process with impersonation rights can elevate privileges to Local System account and completely compromise Windows OSs.

Vulnerability Analysis

While the issues are not critical in nature since impersonation rights are required, they allow to exploit services such as IIS 6, IIS 7, SQL Server, etc. in some specific scenarios. Exploits code for those services will be released. The presentation will be given in a very practical way showing how the new issues were found, with what tools, techniques, etc.

Exploitation and Demonstrations

allowing the participants to learn how to easily find these kind security issues in Windows operating systems Cesar Cerrudo is the founder and CEO of Argeniss (www.argeniss.com), a security consultancy firm based in Argentina. He is a security researcher and consultant specializing in application security. Regarded as a leading application security researcher, Cesar is credited with discovering and helping to eliminate dozens of vulnerabilities in leading applications including Microsoft SQL Server, Oracle database server, IBM DB2, Microsoft BizTalk Server, Microsoft Commerce Server, Microsoft Windows, Yahoo! Messenger, etc.

Remediation and Defensive Strategies

Cesar has authored several white papers on database, application security, attacks and exploitation techniques and he has been invited to present at a variety of companies and conferences including Microsoft, Black Hat, Bellua, CanSecWest, EuSecWest, WebSec. HITB, Microsoft BlueHat, FRHACK, EkoParty, etc. Cesar collaborates with and is regularly quoted in print and online publications including eWeek, ComputerWorld, and other leading journals. For copies of the slides and additional materials please see the DEF CON 18 Archive here:

Related talks