0

I have written my own web server in c++, and now I want it to run with real time priority, but for changing the priority to real time one needs the application to be running in elevated mode. Hence my question Is running a HTTP server elevated a security risk?

Thanks.

nom
  • 151
  • 5
  • I think you should re-evaluate why you're wanting to run it as real-time priority. That, alone, is a risky move. If the process was to get caught in a loop it's very possible a hard reset would be the only way to recover the machine. Real-time priority can interrupt basic input such as Keyboard and Mouse. – Noobixide Apr 26 '15 at 19:06

1 Answers1

1

This question is a bit too broad. But, yes it is a security risk. If a user finds an exploit in your web server, either accidentally or maliciously, he or she may use that exploit to possibly execute code in the security context under which your web server runs... which in your case will be fully elevated, meaning the attacker can thoroughly and completely own your entire server. This is precisely why we don't run web servers under Local System or other administrator accounts. Noobixide's comment is totally valid as well. If an attacker figures out how to DoS your web server, it will be running with real-time priority, and the operating system will be helpless to stop or throttle it. Your entire server will become unusable.

Ryan Ries
  • 55,011
  • 9
  • 138
  • 197