Down the Rabbit-Hole...
Summary: Project Zero's Tavis Ormandy found that unprivileged Windows applications could send messages in the 0xC000-0xFFFF range to privileged windows, contradicting the whitelist in win32k!IsMessageAlwaysAllowedAcrossIL. Tracing the behavior with a debugger led to MSCTF, the Windows Text Services Framework, whose ctfmon service registers these messages and whose undocumented protocol has no access control, letting any application - including sandboxed processes - connect to any CTF session and lie about its thread, process, and window IDs.
What you should know: The CTF protocol has no authentication at all, so any process on the desktop, even a sandboxed one, can connect to the session and impersonate another client - and Ormandy verified the bugs he describes still exist on Windows 7, with the system barely changed since Vista.
Read the original at Google Project Zero ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026