A Google security researcher, 'James Forshaw' has discovered a privilege escalation vulnerability in Windows 8.1 .
The vulnerability resides in the function AhcVerifyAdminContext, an internal function and not a public API, which actually checks whether the user is an administrator.
This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator and thus allows a triggered application to run with elevated privileges. An attacker can then simply migrate to this process and then has local admin rights, which is then “game on”!
If a hacker cannot elevate privileges from a standard user context on a Windows operating system, then practically all they can do is use the compromised system as a pivot to go elsewhere on your network.
It is therefore essential to implement additional security controls to prevent malicious Privilege escalation and not just rely on inbuilt Windows and anti-virus controls.
Avecto’s DefendPoint is a leading solution in this space, which allows the Enterprise to easily manage and enforce least privilege user accounts at a scale on Windows workstation and server operating systems.