Windows StickyKeys could pose security risk

A security researcher said that the StickyKeys function in Vista and XP could allow a user to bypass the login system

A Windows component designed to help disabled users could serve as a backdoor for unauthorised system access, according to a security expert.

McAfee researcher Vinoo Thomas said in an article posted to the company's security research blog that the StickyKeys function in Windows Vista and XP can be exploited to allow a user to bypass the login system. 

StickyKeys allows users to enter key combinations without having to hold and press keys simultaneously. It is launched by pressing the 'shift' key five times in succession.

Thomas pointed out that the component responsible for launching StickyKeys is vulnerable to tampering.

A user could replace the StickyKeys executable (.exe) with a copy of the command prompt (cmd.exe) and launch the prompt by pressing the 'shift' key five times.

This would allow a user to open the command prompt in the Windows log-in screen and tell the machine to load Windows Explorer.

The user would then have complete access to the system with administrator-level privileges without needing the administrator's password.

Microsoft shrugged off the reports in a statement provided to vnunet.com and said that it did not consider the StickyKeys backdoor to be a vulnerability of any sort. 

The company pointed out that, in order to make the edits, a user must already be on an administrator account, thus mitigating the need for a backdoor in the first place.

Thomas acknowledged that administrator access is required, but pointed out that up to 27 per cent of all unauthorised access is committed by internal employees.

Users who had administration rights, or who temporarily found themselves with administrator access, could set up the backdoor and use it later for malicious purposes.

The researcher also pointed out that the StickyKeys trick worked with the remote desktop feature, allowing a user to take control of an affected system from a remote location.

Again, this is a feature that could lend itself to the wrath of disgruntled employees, according to Thomas.

The researcher urged users wishing to mitigate the risk of the StickyKeys feature to uninstall the accessibility options component in Windows.