‘Dolby program may grant administrator access to Lenovo devices’

The Dolby Audio program that would be standard on Lenovo computers running Windows 10 can be used to gain administrative access on these devices. This is because the program is preinstalled with ‘system’ permissions.

This is the DolbyDAX2API.exe file, which, according to the Obscure Channel blog, normally drives audio components on Lenovo devices running Windows 10. The problem lies in the fact that the executable’s permissions are set to ‘system’ level by default, this is the highest level on Windows machines.

The attack presupposes that a user has already acquired local rights to a machine. An attacker can replace DolbyDAX2API.exe with a malicious file, which he can invoke by starting the Dolby Audio program. Because of the high permissions, it is ultimately possible for the attacker to open a shell with administrator access. It is not clear whether the Dolby program is only available on Lenovo devices, or whether other manufacturers also include it as standard.