NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·3h ago
Security
Google Project Zero·8 min read
A Deep Dive into the GetProcessHandleFromHwnd API
TL;DR
A security researcher discovered an undocumented Windows API called GetProcessHandleFromHwnd that lacked clear security documentation. The researcher performed a detailed analysis by examining API documentation, tracing its history, and studying a publicly disclosed UAC bypass vulnerability in Quick Assist.
✦ Why It Matters
Engineers must audit undocumented or poorly-documented APIs for security implications before deployment in privileged contexts.
Key Takeaways
- Investigate the implications of the GetProcessHandleFromHwnd API in your applications.
- Ensure your software adheres to the latest security protocols regarding process access.
- Monitor updates from Microsoft regarding API security changes.
- Consider implementing additional security measures to mitigate potential vulnerabilities.
How It Works
The GetProcessHandleFromHwnd API allows a process to obtain a handle to another process based on its window handle (HWND). Initially, it utilized a Windows hook mechanism to facilitate this, but later versions directly accessed the kernel, bypassing some security checks.
The API checks the integrity levels of processes and their access rights, but flaws in these checks can lead to unauthorized access, especially for processes with UI Access.