Understanding Windows Service Hardening

Windows Service Hardening (WSH) is a feature of Windows Vista and later versions that is designed to protect critical network services running on a system. If a service is compromised, WSH reduces the potential damage that can occur by reducing the attack surface that could be potentially exploited by some forms of malicious code. Because network services (both those built into the operating system and those installed by third-party applications) are by their nature exposed to the network (which itself is usually connected to the Internet), they provide a vector by which attackers can try to compromise a system. WSH implements the following protection improvements over previous versions of Windows:

• Configuring services to run whenever possible within the lower-privileged LocalService or NetworkService context instead of the LocalSystem context favored by many services in previous versions of Windows.
• Implementing a new type of per-service security identifier (service SID) that extends the Windows access control model to services and the system resources they access. When a service is started by the Service Control Manager (SCM), the SID is added to the secondary SIDs list of the process token if the service opted for doing this.
• Applying a write-restricted access token to the process for each service so that any attempt to access a system resource that does not have an explicit allow access control entry (ACE) for the service SID will fail.
• Tightening control over the generic SvcHost.exe grouping and distribution of services.
• Reducing the number of privileges assigned to services to only those needed by the service.