Winternals Tackles Elevation of Privilege Problem with Protection Manager

Published: March 8, 2006

by Alex Woodie

Windows security and utility developer Winternals this week delivered new security software called Protection Manager that's designed to prevent malicious software from taking advantage of one of Windows' most glaring security weaknesses: the elevation of privilege attack.

Due to the way many Windows applications are written, users often must run their Windows operating system in administrative mode for an application to work properly. However, running in this most permissive administrative state can lead to problems, especially as malicious software writers get hip to the problem and start targeting it with their wares.

Microsoft, to its credit, has recognized the problem, and pledges to make sweeping changes to user privileges with the next version of Windows. However, Longhorn won't be in widespread production for another 12 months at least, which, for some users, is an unacceptably long time to be exposed to the problem.

Winternals says its new Protection Manager software provides protection for Windows system right now. The company says it solves the elevation of privilege problem by only allowing authorized applications to run. Applications that haven't been authorized to run are blocked. However, the software does permit legacy applications that would otherwise break if you tried to run them with anything but full administrative privilege to be run in elevated privilege mode, as needed.

Mark Russinovich, co-founder and chief software architect of Winternals, says the new software addresses two of the most prevalent threats to Windows security: malicious software attacks, and the fact that end-users often run with administrative rights. "Protection Manager is the first solution capable of defeating those threats through an approach that prevents all unauthorized applications from executing, merged with a least-privilege environment that provides the minimum necessary user access rights," he says.

Protection Manager is available now for Windows 2000, Windows XP, and Windows Server 2003 systems. Pricing starts at $250 per server, or $25 per workstation, and there is also a console available for centralized management for $69. For more information, go to www.winternals.com.