Contents
How is privilege escalation used in advanced attacks?
A key component in almost all advanced attacks is privilege escalation — an attempt to compromise an account, and then expand the attacker’s privileges, either by gaining control of more accounts or increasing the privilege level of the compromised account.
What are the risks of privilege account escalation?
This can include logging in to their daily use computer and using critical applications and trivial programs (such as a web browser or email). Other risks can include shared accounts and common passwords across accounts. In this article, we provide you with a 3-step guide to preventing privilege account escalation.
Which is more dangerous vertical or Horizontal privilege escalation?
Vertical privilege escalation is typically more dangerous, because it means the attacker is trying to elevate their permissions, with the ultimate goal of gaining administrator or system user rights on Windows, or root on Unix systems.
What can an attacker do with root access?
With root access, the attacker can steal credentials and other sensitive information, execute backdoors and other malware, erase data and otherwise disrupt business operations, or execute arbitrary code. Attackers can also cover their tracks by deleting evidence of their activity. Which account or system did the attacker initially compromise?
What happens when an attacker exploits horizontal escalation?
If an attacker can exploit horizontal escalation vulnerabilities to gain access to another user’s data, you are betraying your users’ trust, which can have reputational, legal, and financial implications.
Why is Horizontal privilege escalation limited to a privileged account?
Horizontal privilege escalation is limited because it does not grant the attacker more powerful permissions, unless the attacker already possesses a privileged account.
Can a compromised account be used for escalation?
There are many ways for compromised accounts to be used. By their nature, privileged accounts will always be a target for use and escalation. The three solutions above block many attack vectors, but a malicious actor only needs to be successful once. Data collection and analysis is both your first and final line of defense.