1

Using Visual Studio 2010 I tried remote debugging a process run by a different user.

To do this my user had to receive "debug" privileges on the test machine, run the remote debugging monitor under my account, and attach from my machine to the remote process, run as the tester's account.

Both when giving my account debug privileges on the test machine, and when attaching to a different user's process on the developing machine, I received security warnings.

What are the actual dangers of giving an user debug privileges, or debugging a process owned by a different user?

Coffee on Mars
  • 988
  • 6
  • 21
  • I can think of one, but there are others. If your debugging (or dump-analyzing) software is buggy and it works with untrusted data, you're risking to be pwned through security holes in it. – Alexey Frunze Dec 16 '11 at 09:57

1 Answers1

1

Debug privileges grant the user the ability to open processes of other users, including system processes (user SYSTEM) like csrss.exe. Essentially, any code running under that user can now inject code into system processes.

See also this entry on Old New Thing and the follow-up.

pezcode
  • 5,490
  • 2
  • 24
  • 37
  • Even being able to open a process as user X exposes all of user X's files and settings, which is an information disclosure risk. – Adrian McCarthy Dec 16 '11 at 17:38