full-disclosure - Question for the Windows pros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Jan 18 23:07:35 2006
From: frank at knobbe.us (Frank Knobbe)
Subject: Question for the Windows pros

On Wed, 2006-01-18 at 16:16 -0600, Paul Schmehl wrote:
> This means that the exposure, when granting the privilege, is as follows:
> 1) If you can launch a process on the local machine AND
> 2) The process has embedded credentials that are different from the user 
> launching the process THEN
> 3) The user gains those credentials' privileges ***for the length of that 
> process***

Yup. So if your use has that right, any spyware the user downloads via
IE can use that user right to elevate credentials **for the length of
the malware installation**. Does that sound right? And does that sound
like something you'd want to happen?

You're caught between a rock and hard spot. You need to install
software, but don't want to give admin rights. So you have to meddle
with user rights in order to install the software, which would leave the
user again vulnerable to "other software" taking advantage of that user
right.

If you give that right, or admin privs, why don't you limit that only to
the duration of the software install? It sounded like you were planning
on granting that user right and leaving it in place. If you only grant
it temporarily, the exposure is not great, imho. (Remember, I've been
liberated from Windows for a couple years now ;)

> So, why did M$ decide to remove this right from the user?  Because it 
> prevents them from installing software on the box.

Right. But now you find yourself having to dish out that right again to
make some software work. What's wrong with that picture? ;)

Cheers,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060118/8ab371b8/attachment.bin