full-disclosure - Re: Windows 7 UAC compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 5 Feb 2009 17:56:44 -0200
From: "M.B.Jr." <marcio.barbado@...il.com>
To: Jimmy Astle <astle.j@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	Valdis.Kletnieks@...edu, Miller Grey <vigilantgregorius@...il.com>
Subject: Re: Windows 7 UAC compromised

Dear Jimmy,
you say you can't see how they missed the "privileges management" point.

You need to study UNIX.
Notwithstanding, being somewhat benevolent with you, just study SELinux.

Maybe you see sth, then.


Regards,




On Thu, Feb 5, 2009 at 5:17 PM, Jimmy Astle <astle.j@...il.com> wrote:
> I am new to the list so hello to everyone.....
>
> Now for the Windows 7 UAC stuff.
>
> 1.) Its beta.... its not going to be perfect wait for RC1 before selling 7
> down the river.
> 2.)
> http://www.informationweek.com/news/security/app-security/showArticle.jhtml?articleID=213001021&subSection=News
>
>                It all comes back to windows biggest issue, joe the plumber
> shouldn't not be running as a local admin on his box. UAC problem solved!  I
> still dont see how redmond missed the concept.
>
>
>
> On Thu, Feb 5, 2009 at 1:52 PM, Miller Grey <vigilantgregorius@...il.com>
> wrote:
>>
>> ...what?
>>
>> On Tue, Feb 3, 2009 at 3:40 PM, M.B.Jr. <marcio.barbado@...il.com> wrote:
>>>
>>> Windows says: Hello world! Check this out, world, this is really cool.
>>> Now I have, uh, something like, uh, "privileges management"!
>>>
>>>
>>>
>>> "UAC" is no more than a new commercial designation for something with
>>> about 40 years.
>>> And they (Redmond) are still missing the concept's point.
>>>
>>>
>>>
>>>
>>>
>>>
>>> On Mon, Feb 2, 2009 at 5:14 PM, Christopher Pritchard
>>> <mailinglist@...iniacghost.co.uk> wrote:
>>> >> The biggest issue here is that although it's technically easy to fix
>>> >> this problem (just have UAC issue an alert when somebody's messing
>>> >> with
>>> >> the system settings), it involves doing more of what end users dislike
>>> >> most about UAC (it issuing alerts to Joe Sixpack all the time when he
>>> >> does something bone-headed security-wise).
>>> >>
>>> >> Fixing this one in a way that users will put up with will be a bitch.
>>> >
>>> > Why not just have it not prompt if you are changing settings, except
>>> > for UAC settings? that would be the simple way around it
>>> >
>>> > _______________________________________________
>>> > Full-Disclosure - We believe in it.
>>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> > Hosted and sponsored by Secunia - http://secunia.com/
>>> >
>>>
>>>
>>>
>>> --
>>> Marcio Barbado, Jr.
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>



-- 
Marcio Barbado, Jr.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/