GoKawiilWritten by: Farid Mustafayev, Cybersecurity Expert at ThreatLocker
Named pipes are a common choice for communication between applications running on the same Windows computer. They are fast, supported directly by the operating system, and work well for communication between Windows services, desktop applications, tray processes, command-line utilities, and background agents.
A typical design may include a privileged Windows service acting as the named-pipe server while a user-facing application connects as the client. Because both processes run on the same computer, developers often treat this communication as internal and therefore trusted.
In practice, the pipe is accessible from an environment where many unrelated processes may be running under different users, sessions, and security contexts.
Local Does Not Mean Trusted
Named pipes are often treated as private because they are used for communication between applications on the same computer. That assumption is unsafe.
A Windows workstation may run processes under LocalSystem , administrators, standard users, service accounts, and separate interactive or remote sessions. It may also contain third-party software, scripts, diagnostic tools, and malware operating under a compromised account.
Any process that knows the pipe name and has sufficient access rights can attempt to connect. Windows does not inherently know which executable the developer intended to use the pipe.
For that reason, a named pipe should be treated as an exposed local interface. Before processing a request, the application must determine who connected, what that identity is allowed to do, and whether the supplied data is safe.
Identity, Access Control, and Privilege Boundaries
... continue reading