full-disclosure - MS Windows Screensaver Privilege Escalation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7DA438C75CC4186B7191A1CB@utd49554.utdallas.edu>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: MS Windows Screensaver Privilege Escalation

--On Sunday, November 28, 2004 09:41:23 PM +1300 Nick FitzGerald 
<nick@...us-l.demon.co.uk> wrote:
>
> That's because it is (more than) pretty stupid to let users install
> software at all.  The job of system administrators is to "manage" the
> systems they are responsible for.  With Windows systems that requires
> that "ordinary users" (i.e. everyone whose job is not officially
> "system administrator") _MUST NOT_ be allowed to install new software.
> Sadly, extraordinarily few Windows system admins actually have enough
> nouse to realize this, and most of the few who do cannot get enough
> management muscle to back such a "draconian" policy.
>
This model breaks down, of course, in the home market, where people want 
unfettered access to their computer.

What we need is a paradigm shift in thinking about security and computers. 
We need "users" to be required/forced? to change accounts to install 
software.  Something like a virtual session, so that, when they're logged 
in, and they decide they want to install something, when they attempt to 
install, the system forces them into a virtual session, authenticates them 
as root/admin and performs the install within that session.  Once the 
install completes, the session closes, and they're back to "joe user" again.

People could still override this, but they would (obviously) have to be 
somewhat knowledgeable to do it.  (Really what we need is the unix model, 
where users can never be admins and admins *should* never be users, but we 
*all* know that's never going to happen.)

Just last night my 28 year old daughter was complaining about having to 
update her laptop.  She called it "a second job" that she wasn't paid for. 
She yearns for "automated updates" that she doesn't have to deal with.  On 
a corporate network, that's doable, but at home???  I explained to her why 
trusting her computer's updates to someone else was a bad thing, but that 
only made her more knowledgeable, not more happy.  :-)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu