Injecting Code into Windows Protected Processes using COM - Part 2
Summary: Google Project Zero's James Forshaw demonstrated injecting arbitrary code into a full Protected Process at WindowsTCB level without administrator privileges, after his earlier technique only reached PPL-WindowsTCB. He found that WerFaultSecure.exe and SgrmBroker.exe run at WindowsTCB, and abused the IRundown interface's DoCallback method, which executes an arbitrary function pointer if the caller supplies the process's randomly generated GUID secret and a valid server context.
Bottom line: The only barrier between an attacker and arbitrary code execution in a WindowsTCB process is a per-process random GUID that must be read from memory, so any primitive that leaks process memory collapses that boundary entirely.
Read the original at Google Project Zero ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026