Privilege escalation is a computer exploit that allows a user to access privileges extended to another user, potentially creating a vulnerability where a hacker could reconfigure a system and perform illegal operations. There are three levels: deescalation, where a user actually has fewer privileges; horizontal escalation; and vertical escalation. These work in a number of different ways. Horizontal and vertical escalation tend to be of the greatest concern.
In vertical privilege escalation, a user has administrative access to a computer when this should not be possible. Such access can allow users to change system settings, create new users, authorize activities, and engage in a wide variety of other mischief. This can be a potentially serious security flaw on a network, where a user with administrative privileges could extract data from the computers of network users or create loopholes to exploit later.
Horizontal cases of privilege escalation involve situations where people have access controls under the account of a different user. In an office, for example, User A could access User B's account. Both accounts may have the same number of system privileges in terms of being able to make changes and perform operations. They contain different information, however, and User A could do things like deleting or moving files, accessing confidential information, or issuing orders under User B's name. This can be a big problem in something like an online banking system, where a funds transfer would appear legitimate because it originated from a user's own account.
Administrators can use deescalation, downgrading to privileges as a regular system user. In some cases, this can be a security measure. The administrator may opt to switch to a lower-level account to perform basic tasks, rather than being logged in as an administrator, which could create a security threat. Accidentally leaving an administrator account open could allow an unauthorized person to use that account, for instance, or might create a window for a hacker or cracker to use.
There are a number of steps that technicians can use to address concerns about privilege escalation. Programmers test operating systems and programs thoroughly before use to check for this and other potential exploits. Users who notice problems should report them, as these may help designers and information technology professionals identify and patch security problems. There may also be some security setting changes that could be made to limit privilege escalation attacks and keep the system safe.
