What is privilege escalation and how to prevent it?

What are privilege escalation attacks?

The scope of permissions associated to a user depends on how privileged the user role is. Some of the privileged roles in an organization include the system administrators, payroll administrators, IT help desk technicians, and network and database administrators. These employees use privileged accounts to gain access to their respective target endpoints. Since privileged accounts enable elevated access to critical systems, enabling fine-grained permissions right at the user level or group level ensures secure access to privileged endpoints. However, if these privileged accounts are exposed to malicious insiders or external attackers, it can spell doom to the overall security of the enterprise.

Types of privilege escalation

Privilege escalation can be carried out for a role of any level of permission. There are two methods to escalate privileges:

• 01

  Horizontal privilege escalation allows a user to gain permissions of a fellow user with the same privileges to gain access to personal information. However, the challenge is that this might be a standard user account with basic privileges and the hacker will need to elevate their privileges to perform higher level actions.

  For example, an employee using a fellow user's credentials to access critical information aims to impersonate the users with the same privileges. Despite having similar access permissions, impersonating a fellow employee gives the attacker access to that employee's PII. This type of escalation is usually carried out using social engineering techniques.

• 02

  Vertical privilege escalation is when a user with non-administrative permissions gains access to administrative permissions, which are otherwise unavailable. Vertical privilege escalation provides direct access to critical enterprise resources without having to request for elevated account privileges.

For example, a user with standard privileges gaining access to a user account with relatively higher privileges can view and modify confidential data about every employee. This is a privileged action that is usually not under the purview of the standard user.

How does privilege escalation work?

Privileged accounts are the gateways to critical information and inadequate security over them will take a toll on both revenue and reputation of the enterprise. During a privilege escalation attack, hackers initially target standard user accounts to acquire bare minimum privileges. However, these accounts don't suffice when it comes to carrying out activities that require higher privileges. So, how does a bad actor navigate further into the sensitive areas of the organization?

Let's consider the following example: When a non-admin user is granted temporary privileges to perform high-level actions like adding or deleting users, executing privileged commands, or running customers reports, it is important that the access permissions are revoked once the intended task is completed. These permissions are susceptible to phishing or social engineering attacks and, if one of these attacks is successful, an unauthorized user can gain access. Additionally, a higher number of privileged accounts raises the chances that one of these will be targetted to perform nefarious activities over the enterprise network.

Five common privilege escalation attack vectors

Following are top controls that a PAM software should provide to enable PAW users.

• 01

  Credential exploitation

  Credentials, if associated with administrative accounts, can provide attackers with elevated privileges across multiple systems. In some cases, credentials are stored in plaintext or reused across services, making it easier for attackers to gain lateral network access. Once valid login details are in hand, an attacker can move laterally within the network or escalate access by impersonating administrative users.

• 02

  System misconfigurations

  Poorly configured permissions, such as giving permanent administrative access to critical services, can allow for usage or execution of unauthorized operations. Another common misconfiguration involves services or scheduled tasks running root-level privileges that can be hijacked or overwritten by attackers. In cloud environments, overly broad IAM policies or insecure default settings can also open the door to privilege abuse.

• 03

  Malware-based escalation

  Malware and rootkits are often engineered specifically to escalate privileges once they’ve infiltrated a target system. These malicious programs may exploit kernel-level vulnerabilities, inject code into privileged processes, or install themselves as services with administrative rights. Some malware strains also include privilege escalation modules designed to bypass user account control or escalate permissions silently.

• 04

  Social engineering

  By manipulating human behavior, attackers can gain access to elevated credentials or convince users to perform actions that grant additional permissions. For instance, a phishing email might trick a helpdesk agent into resetting an admin password or persuade a user to install remote access software under the guise of IT support. Unlike technical vulnerabilities, social engineering preys on trust, urgency, and lack of awareness.

• 05

  Software and operating system exploits

  Unpatched vulnerabilities in operating systems and third-party software are frequent targets for privilege escalation. These exploits take advantage of security flaws that allow a non-privileged user or process to execute code at a higher level. Examples include buffer overflows, race conditions, DLL injection, or kernel-level bugs which allow attackers to access sensitive registry hives and escalate privileges. Attackers often chain these exploits with initial access to perform full compromise.

Privilege escalation attack based on OS

Impact of privilege escalation: why is it important to prevent it?

Privileged accounts are the keys to the kingdom; when privileged accounts are shared between multiple users and there's no monitoring of their use, they're more at risk of being used by a malicious actor. These threat actors attempting privilege escalation will try to:

• Gain unlimited access to critical information.
• Modify data by impersonating an administrative user.
• Manipulate access-level controls of various users.
• Create loopholes for effortless data exfiltration during future attempts.

These backdoors, when successfully deployed, allow hackers to bypass default authorization channels and elevate permissions without any hassle.

How can enterprises effectively prevent privilege escalation attacks?

Mitigating privilege escalation attacks calls for deploying efficient access management tools. Here are some access management best practices to prevent privilege escalation

• Consolidate privileged account credentials under a central console.
• Enforce MFA to ensure an added layer of security for access to critical information.
• Apply the lowest level of access privileges by assigning the bare-minimum privileges for user accounts based on their roles to prevent unauthorized access to sensitive endpoints. If these users require higher privileges, they can be provided temporary admin access to sensitive resources.
• Facilitate secure sharing and rotation of credentials, and eliminate hard coding of passwords in plain-text formats.
• Prevent unauthorized access to critical endpoints by implementing request-release mechanisms that mandate an admin's approval before granting permissions.
• Grant fine-grained access to run and execute allow-listed applications and SSH commands.
• Implement just-in-time privilege elevation to grant users elevated access to resources only based on need, and revoke permissions after a stipulated period.

Defend against privilege escalation attacks with ManageEngine PAM360

Exhibiting a strong security posture requires continuous effort. Ensuring a reduced attack surface helps enterprises further reduce the risk of a data breach.

ManageEngine PAM360 is an enterprise privileged access management software that helps organizations combat privilege escalation attacks with granular least privilege access controls, such as role-based access, policy-based access, dynamic trust scoring, just-in-time privilege elevation, and application and command control. PAM360's comprehensive Zero Trust controls help enterprises ensure zero standing privileges and secure their privileged access routines against emerging threats.