"Windows Automatic Update" or a backdoor

I have four partitions on my computer, say c,d,e and f.Out of these windows is installed on c drive.
And I have two users on my computer, one is admin and another is InternetUser.I have configured the Internet User in such a way that it has zero permissions on my system except that it can be used to surf the net(with some defined firewall rules) and save a few files on its desktop.Except this it can't do anything on my computer.

I use internet only from InternetUser.
But still windows is able to "automatically update" my system.How can it write(update) my system from InternetUser and that also remotely.I think windows has some backdoor preinstalled on the OS.How can I find more about it,so that I can "update" others computers remotely.:D

Also I think that if I use a kernel level debugger(like Softice or Windbg) and monitor the system while it is connected to internet,I could find out more about this "automatic update".Had anybody done it before?

I think that Windows Updater runs as "system" if it is activated, so it doesn't matter which user is actually logged in.

To find out how to remotely update computers on a network, go to the MS update site and select the " use administrator options" down the left hand side.

See, there are many 'type' of users as you may be knowing. One of the most powerful account is named as 'system'. This account has elevated privileges, much more than that of the administrator. It is said that even administrator cannot change anything in the SAM (password file of windows). It is this account that does.

The system account is used to run the very essential system services. As far as Windows update is concerned, It is done via the process named as 'svchost.exe'. It has multiple instances running under its name each of which gives a particular service to you. There is no way you can DENY permissions to this process (or file for the sake of firewall rules) as this process is the opne which sends and recieves the DNS requests and passes it on to the applications.

svchost.exe would run under system account and so, you do not have a power to change many things related to the process (of course due to its elevated priviledges).

If you want to disable the automatic updates, I think you know that way. (it is: My computer ==Right Click==> properties ==> Automatic updates ==> disable and then OK).

Yes, there are quite a few applications that check for updates and even apply them automatically. Antivirus products do it, ZoneAlarm firewall, et cetera.

All you need to do is open a connection to an ISP. Provided that the task was initially set up with adequate permissions, it will run as soon as any user makes the connection.

To find the programs and files being used by Windows Update, search your Windows partition for wu*.*

Can't we get into this "system account" ?

No, not by "normal methods" as it isn't a regular user account, but you can "hack" it:

http://tech-hutblog.blogspot.com/200...m-account.html

I can't say I can think of why you would want or need to do this though.

Quote:

---

Originally Posted by jockey0109

See, there are many 'type' of users as you may be knowing. One of the most powerful account is named as 'system'. This account has elevated privileges, much more than that of the administrator. It is said that even administrator cannot change anything in the SAM (password file of windows). It is this account that does.

The system account is used to run the very essential system services. As far as Windows update is concerned, It is done via the process named as 'svchost.exe'. It has multiple instances running under its name each of which gives a particular service to you. There is no way you can DENY permissions to this process (or file for the sake of firewall rules) as this process is the opne which sends and recieves the DNS requests and passes it on to the applications.

svchost.exe would run under system account and so, you do not have a power to change many things related to the process (of course due to its elevated priviledges).

If you want to disable the automatic updates, I think you know that way. (it is: My computer ==Right Click==> properties ==> Automatic updates ==> disable and then OK).

---

wuauclt.exe is the windows update automatic update client. That program maintains the local database of windows updates. The database (as well as update downloads) is stored in %windir%\softwaredistribution. You can safely delete this folder. The next time wuauclt is run, it will recreate it.

svchost controls both wuauclt and BITS (background intelligent transfer service) svchost will run wuauclt depending on your automatic update settings.

You can stop both of these one or both of these services from running by going to into services.msc and setting the Automatic Update and Background Intelligent Transfer Service (BITS) to either manual or disabled. I think that if you you set it to disabled, then you will not be able to use the Windows Update website either.

You can also control the windows update settings via the gpedit.msc or the way jockey0109 describes. :)

Yes, as far as the %systemroot%\SoftwareDistribution is concerned about it, I was aware about it (had applied updates to a newly installed OS copy from that of an already existing one on the same machine ;) ) Now, yes thats the way update takes place. I did not know about the BITS (thanks for that). But my intension was not to tell him that how Windows update takes place in particular. Since he asked about a backdoor, I thought it would have been better to tell about the system account.

Of course for most of the things that WIndows does, there is either a way from the policy side (gpedit) or the service side (services).

And as far as this is concerned:

Quote:

---

No, not by "normal methods" as it isn't a regular user account, but you can "hack" it:

http://tech-hutblog.blogspot.com/200...m-account.html

I can't say I can think of why you would want or need to do this though.

---

I would certainly ask the person who wrote it if he has tried it himself or not. As far as my small knowlege goes and as per my experience too! ; system account is not able to start ANY PROCESS WITH A VISIBLE WINDOW! If you try to start Explorer.exe under system account, slowly and slowly your desktop will go away, then you will see the buttons of minimize, restore and close balkening out, takbar giogng away, many services will start crashing ans so on.

Thats not the way you hack into your SYSTEM account. Yes, the at command can be used to run programs with SYSTEM privileges but you cannot start a program which has visible windows and dialogue boxes to operate normally with SYSTEM account.

Thats as per my experience. Tell me if anyone else has got a success in running it that way! I would like to know HOW!!!

Quote:

---

you cannot start a program which has visible windows and dialogue boxes to operate normally with SYSTEM account.

---

but "a visible window and dialogue boxes" are not required to understand the working of some process.One can always start the process inside the kernel level debugger and monitor its behaviour.

I am not telling that you cannot start the program. Nor am I telling that it is required. Actually the page that has been linked to in tha post says that by starting EXPLOERE.EXE in system account (after shutiing its context in the currend user space), you can enjoy the privileges that WINDOWS enjoys itself! Now Explorer.exe has got Windows, as you must be knnwing that Mycomputer and the startment and taskbar are all the elements of the explorer.exe process. SO that trick won't work to get privileges over the system with whole desktop up in the SYSTEM account. Got what I wanted to say?

Quote:

---

Originally Posted by jockey0109

Yes, as far as the %systemroot%\SoftwareDistribution is concerned about it, I was aware about it (had applied updates to a newly installed OS copy from that of an already existing one on the same machine ;) ) Now, yes thats the way update takes place. I did not know about the BITS (thanks for that). But my intension was not to tell him that how Windows update takes place in particular. Since he asked about a backdoor, I thought it would have been better to tell about the system account.

Thats not the way you hack into your SYSTEM account. Yes, the at command can be used to run programs with SYSTEM privileges but you cannot start a program which has visible windows and dialogue boxes to operate normally with SYSTEM account.

Thats as per my experience. Tell me if anyone else has got a success in running it that way! I would like to know HOW!!!

---

I was just trying to elaborate on what you had said about windows update. In this instance, it is important to tell them how windows update works and which services/programs are involved. I was explaining how windows update works so they can understand that it is a normal system function and not some backdoor.

BTW: You can run a program as system that has visable windows, etc.

Do the following.

Log on as admin, or "run as" the command prompt as admin.
Make sure the task scheduler is running.

create a task using the at command to start taskmgr one minute from your current time.

at 13:48 /interactive taskmgr

(you have to change the 13:48 to be whatever is one minute past your current time)
one minute later, it will open the task manager. if you look at processes, it will be running as SYSTEM. from there, you can use the new task button under the applications tab to start any program under the same SYSTEM privledges. Whatever you want. cmd, internet explorer, firefox, whatever. As you know, all those programs have visible windows. ;)

Well, lemme try, I have not tried it with taskmgr till now! I will get back soon (actually, VMWARE is what I will test it on .... who's gonna risk WIndows!)

Hell yes, that was right! I did not know about the /interactive switch! Thanks for that... but still, some files like SAM are inaccessible! However the registry entry for SAM was open to be exploited!

but I noticed tht the trick does not work if I log onto another acount with admin privileges. It worked only when I used the account whose NAME is also administrator.

Hmm, not sure why. I created a new admin account. Then I renamed and disabled my default admin account. I'm running under a different SID all together and just as an account in the admin group. Mine seems to work fine on both Windows XP PRO SP2 and Windows Media Center 2002 SP2.

I have a vista ultimate box here that I just started exploring. I'll have to see if you can do it with Vista too.

Quote:

---

I was explaining how windows update works so they can understand that it is a normal system function and not some backdoor.

---

That is true, but there was a bit of a fuss a few weeks ago when the Updater updated itself without asking user permission, even if updates had been turned off. :eek:

Now I am not using the WIndows much, but certainly, that was something I did not read anywhere else than AO (actually I go for a limited no. of sitesdue to time boundaries). And of cours, that is a good thing .... only that its good just for MS. And this should reduce the no. of pirated copies.

Hi Jockey,
I posted this no long time ago.its interesting read.its link there on the page
http://antionline.com/showthread.php?t=275939

Off Topic//

I run ZoneAlarm on this box, and I updated it fairly recently............. It now asks me for permission to go to the "mainframe" and see if there is an update.

I guess some outfits have taken a lesson from the very negative response that M$ got? :D

\\

hmmm... well, question is: did MS got it right? Now I seriously do not think that it was a real nice idea to get their software update itself despite the denial of permission by its own USER! MS talks everythnig about themselves and all that goes right with them but never about the rules that it breaks and specially those which were made and showcased by MS itself!