Google exposes Windows 8.1 security flaw

Google has exposed a security flaw in Windows 8.1, saying it decided to uncover the problem because Microsoft didn't fix it in time.

The bug, which allows application data to be cached when processes are created by an administrator, doesn't correctly check the impersonation token of the caller, meaning anyone could bypass the required checks.

The post on Google's Security Research blog said the system call, "reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check."

Hackers could potentially use this vulnerability to gain access to systems and applications on a user's computer that would normally only be available to administrators. It could also allow anyone to make themselves an administrator and access server functions.

Microsoft responded to the public exposure, saying: "We are working to release a security update to address an Elevation of Privilege issue. It is important to note that for a would-be attacker to potentially exploit a system they would first need to have valid logon credentials and be able to log on locally to a targeted machine. We encourage customers to keep their anti-virus software up to date, install all available Security Updates and enable the firewall on their computer."

The bug was discovered as part of Google's Project Zero, which seeks out bugs in a range of operating systems and platforms before privately notifying the companies responsible for applying a fix. If the company fails to act on Google's alert within 90 days, information about the flaw is released to the wider world.

The blog continued: "This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public."