# Privileged helper trusts stale caller identity

Helper checks signature, PID, token or static secret but not version or full identity at action time

_Area: Memory corruption and native code. Seen in 2 disclosed reports; one confirmed bounty: $250; latest 2025-03-20. Updated 2026-10-23._

## How it works
A privileged component (service, driver, XPC/RPC helper) decides a caller is trusted by checking one identity attribute: a code signature, a PID, a token, or a hardcoded secret. The assumption that breaks is that this attribute uniquely and durably identifies a trusted caller. A signature stays valid across older, injectable builds of the same vendor app [E3](https://bugbountylibrary.com/r/h1%3A966494.md). A protection applied to one access right leaves adjacent securable objects open, so a PPL process's token can still be modified [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md). A driver gates destructive IOCTLs behind a static password, so anyone who learns the constant is trusted [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md). When an untrusted party can make the attribute match a trusted value, the helper acts as a confused deputy and does privileged work on the attacker's behalf.

## Where it shows up
- Helper that checks code signature but not bundle version or identifier [E3](https://bugbountylibrary.com/r/h1%3A966494.md)
- Protection applied to one access right (e.g. PROCESS_TERMINATE) while the process token stays writable [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md)
- Driver IOCTLs gated by a hardcoded password or caller-supplied symbol map [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)
- Caller validation keyed on PID or a cached identity that is never revalidated (plausible extension; not directly shown in evidence)

## How to review
Identify every privileged entry point and the exact predicate used to trust the caller. The invariant: the trust decision must be bound to an identity the caller cannot forge, reuse, or downgrade, and must be re-evaluated at the moment of the privileged action. Check that signature checks also pin version and bundle ID [E3](https://bugbountylibrary.com/r/h1%3A966494.md); that all access rights on the process and its token are protected together [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md); and that driver IOCTLs require real authentication, not an embedded constant [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md).

## Variants seen
- Signature-only check accepting an older injectable build [E3](https://bugbountylibrary.com/r/h1%3A966494.md)
- PPL token left unprotected while process termination is blocked [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md)
- Signed driver with hardcoded-password IOCTLs [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)

## Why fixes fail
E3's earlier fix added a signature check but omitted version pinning, so the old vulnerable binary still passed [E3](https://bugbountylibrary.com/r/h1%3A966494.md).

## Impact and severity
Local privilege escalation to root/SYSTEM [E3](https://bugbountylibrary.com/r/h1%3A966494.md), Defender and EDR disablement [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md), and arbitrary process termination [E1](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md). Severity is high; worse when the trusted artifact is legitimately signed or the secret is static.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-abyssworker.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-sandboxing-antimalware-products.md
- E3: https://bugbountylibrary.com/r/h1%3A966494.md