From: andrewinternational at gmail.com (Andrew Kennedy)
Subject: MS Windows Screensaver Privilege Escalation

On 29 Nov 2004, at 16:40, Paul Schmehl wrote:
> --On Sunday, November 28, 2004 09:41:23 PM +1300 Nick FitzGerald 
> <nick@...us-l.demon.co.uk> wrote:
>>
>> That's because it is (more than) pretty stupid to let users install
>> software at all.  The job of system administrators is to "manage" the
>> systems they are responsible for.  With Windows systems that requires
>> that "ordinary users" (i.e. everyone whose job is not officially
>> "system administrator") _MUST NOT_ be allowed to install new software.
>> Sadly, extraordinarily few Windows system admins actually have enough
>> nouse to realize this, and most of the few who do cannot get enough
>> management muscle to back such a "draconian" policy.
>>
> This model breaks down, of course, in the home market, where people 
> want unfettered access to their computer.

well, for what it's worth, OSX offers this kind of thing. at system 
installation, an 'Adminstrator' privileged account is created, for the 
main user of the computer. this basically means that 'sudo' access is 
granted to this user. whenever 'dangerous' things, like access to 
protected directories, chamging network settings, reconfiguring bits of 
the system, the user's password must be re-entered (*not* a 'root' 
password, mind). this tips the user off that something important is 
happening, and gives them a chance to back out or stop and think about 
what they've done.

in fact, under OSX, there is by default no 'root' user - it must be 
specially asked for and created, as part of the 'BSD' package. i won't 
say apple have gotten things perfect, for example the 'Applications' 
folder is writeable by any user, so rogue apps can be installed by any 
idiot, and a lot more besides, but it goes a long way in front of 
windows (which is mostly due to the BSD heritage...)

> What we need is a paradigm shift in thinking about security and 
> computers. We need "users" to be required/forced? to change accounts 
> to install software.  Something like a virtual session, so that, when 
> they're logged in, and they decide they want to install something, 
> when they attempt to install, the system forces them into a virtual 
> session, authenticates them as root/admin and performs the install 
> within that session.  Once the install completes, the session closes, 
> and they're back to "joe user" again.
>
> People could still override this, but they would (obviously) have to 
> be somewhat knowledgeable to do it.  (Really what we need is the unix 
> model, where users can never be admins and admins *should* never be 
> users, but we *all* know that's never going to happen.)
>
> Just last night my 28 year old daughter was complaining about having 
> to update her laptop.  She called it "a second job" that she wasn't 
> paid for. She yearns for "automated updates" that she doesn't have to 
> deal with.  On a corporate network, that's doable, but at home???  I 
> explained to her why trusting her computer's updates to someone else 
> was a bad thing, but that only made her more knowledgeable, not more 
> happy.  :-)

-- 
-- andrew kennedy ? international : copyright two thousand and four

Powered by blists - more mailing lists