Windows Exploitation Tricks: Spoofing Named Pipe Client PID
&gt;It was clear that there must be some applications which use the client PID for the purposes of security enforcement. However I couldn’t find any first-party applications installed on Windows which used the PID for anything security related. Third-party applications are another matter and other researchers have found examples of using the PID to prevent untrusted callers from accessing privileged operations, a recent example was Check Point Anti-Virus. As relying on this PID is dangerous I decided I should highlight ways of spoofing the PID value so that developers can stop using it as an enforcement mechanism and demonstrate to researchers how to exploit such dangerous checks.<p>So, <i>not</i> a &quot;Windows Exploitation Trick&quot;.<p>Even the so-called &quot;example&quot; with Checkpoint is nothing of that sort. They were using the PID to find the executable and verify that it was signed with their certificate. The actual exploit in the link to the Checkpoint vulnerability has to do with spoofing the cert, nothing to do with the PID.<p>The post is about a bullshit hypothetical &quot;authentication&quot; method that I have never seen anyone use in 25+ years of Windows programming.<p>Edit: clarify last sentence<p>I lost all respect for Project Zero this week.