Detecting privilege escalation achieved by manipulating settings

1 . A method comprising:

generating a safe copy of a first control block for an operating system, wherein the first control block defines one or more security settings and privileges for the operating system;

recording the safe copy in memory;

initiating a test of an authorized service associated with the operating system;

identifying a vulnerability for the authorized service, comprising:

comparing a state of the first control block after the test of the authorized service with the safe copy recorded in memory; and

initiating an action to alleviate the identified vulnerability.

2 . The method of claim 1 , wherein identifying the vulnerability for the authorized service further comprises:

identifying a privilege escalation vulnerability based on the comparing the state of the first control block after the test of the authorized service with the safe copy recorded in memory.

3 . The method of claim 2 , wherein the first control block comprises a security related control block.

4 . The method of claim 3 , wherein the first control block comprises at least one of an accessor environment element (ACEE) block or a job step control block (JSCB).

5 . The method of claim 4 , wherein the first control block comprises an ACEE block, the method further comprising:

generating a second safe copy of a JSCB for the operating system; and

recording the second safe copy in memory,

wherein identifying the vulnerability for the authorized service further comprises comparing a state of the JSCB after the test of the authorized service with the second safe copy recorded in memory.

6 . The method of claim 2 , wherein initiating the action to alleviate the identified vulnerability comprises:

initiating at least one of: (i) an alert or (ii) generation of a report; and

restoring the first control block to baseline by, after the test, replacing the first control block with the safe copy recorded in memory.

7 . The method of claim 1 , further comprising:

generating a second safe copy of a second control block for the operating system;

setting a timer to check for storage alteration relating to the second control block;

initiating operation of the authorized service; and

upon expiration of the timer, identifying a second vulnerability for the authorized service based on comparing the state of the second control block with the second safe copy recorded in memory.

8 . The method of claim 1 , wherein recording the safe copy in memory comprises:

generating a transformed version of the first control block; and

recording the transformed version of the first control block in memory.

9 . A non-transitory computer program product comprising:

one or more non-transitory computer readable media containing, in any combination, computer program code that, when executed by operation of any combination of one or more processors, performs operations comprising:

generating a safe copy of a first control block for an operating system, wherein the first control block defines one or more security settings and privileges for the operating system;

recording the safe copy in memory;

initiating a test of an authorized service associated with the operating system;

identifying a vulnerability for the authorized service, comprising:

comparing a state of the first control block after the test of the authorized service with the safe copy recorded in memory; and

initiating an action to alleviate the identified vulnerability.

10 . The non-transitory computer program product of claim 9 , wherein identifying the vulnerability for the authorized service further comprises:

identifying a privilege escalation vulnerability based on the comparing the state of the first control block after the test of the authorized service with the safe copy recorded in memory.

11 . The non-transitory computer program product of claim 10 , wherein the first control block comprises a security related control block.

12 . The non-transitory computer program product of claim 11 , wherein the first control block comprises at least one of an accessor environment element (ACEE) block or a job step control block (JSCB).

13 . The non-transitory computer program product of claim 12 , wherein the first control block comprises an ACEE block, the operations further comprising:

generating a second safe copy of a JSCB for the operating system; and

recording the second safe copy in memory,

wherein identifying the vulnerability for the authorized service further comprises comparing a state of the JSCB after the test of the authorized service with the second safe copy recorded in memory.

14 . The non-transitory computer program product of claim 10 , wherein initiating the action to alleviate the identified vulnerability comprises:

initiating at least one of: (i) an alert or (ii) generation of a report; and

restoring the first control block to baseline by, after the test, replacing the first control block with the safe copy recorded in memory.

15 . A system, comprising:

one or more processors; and

one or more memories storing a program, which, when executed on any combination of the one or more processors, performs operations, the operations comprising:

generating a safe copy of a first control block for an operating system, wherein the first control block defines one or more security settings and privileges for the operating system;

recording the safe copy in memory;

initiating a test of an authorized service associated with the operating system;

identifying a vulnerability for the authorized service, comprising:

comparing a state of the first control block after the test of the authorized service with the safe copy recorded in memory; and

initiating an action to alleviate the identified vulnerability.

16 . The system of claim 15 , wherein identifying the vulnerability for the authorized service further comprises:

identifying a privilege escalation vulnerability based on the comparing the state of the first control block after the test of the authorized service with the safe copy recorded in memory.

17 . The system of claim 16 , wherein the first control block comprises a security related control block.

18 . The system of claim 17 , wherein the first control block comprises at least one of an accessor environment element (ACEE) block or a job step control block (JSCB).

19 . The system of claim 18 , wherein the first control block comprises an ACEE block, the operations further comprising:

generating a second safe copy of a JSCB for the operating system; and

recording the second safe copy in memory,

wherein identifying the vulnerability for the authorized service further comprises comparing a state of the JSCB after the test of the authorized service with the second safe copy recorded in memory.

20 . The system of claim 16 , wherein initiating the action to alleviate the identified vulnerability comprises:

initiating at least one of: (i) an alert or (ii) generation of a report; and

restoring the first control block to baseline by, after the test, replacing the first control block with the safe copy recorded in memory.