full-disclosure - Re: Windows 7 UAC compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20090206145342.159A328040@smtp.hushmail.com>
Date: Fri, 06 Feb 2009 09:53:41 -0500
From: "Elazar Broad" <elazar@...hmail.com>
To: astle.j@...il.com, yr42.lists@...il.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows 7 UAC compromised

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Exactly, so we only make him click for non system
applets/utilities, and we determine that by digital signatures,
which is exactly how UAC is implemented in Windows 7. With that
said, now we are back to the original issue, a computer is only as
smart(or dumb, my apologies to the AI crowd) as the guy who
programmed it, or in other words, how hard(or easy) is it to spoof
a system applet/utility?

Human nature dictates(most of the time) that we can become
desensitized to things that are routine or occur often, in other
words, the more UAC prompts, the more blind clicking, then again,
did Joe Sixpack bother to read the first UAC prompt when he started
up his shiny new Vista for the 1st time.

Now, if we wired UAC up to a mouse with an electrode embedded in
the left mouse button, we might have a solution. Of course the
voltage would need to increase slightly over the life of the mouse
in order to solve the blind shock and click problem...

elazar

On Fri, 06 Feb 2009 05:57:03 -0500 Yudi Rosen
<yr42.lists@...il.com> wrote:
>But Joe the Plumber doesn't want to have to click on endless
>'confirm'
>dialogs every time he tries to use the computer. Simply having him
>run as a
>non-admin user only fixes half the problem.
>
>On Thu, Feb 5, 2009 at 9:17 PM, Jimmy Astle <astle.j@...il.com>
>wrote:
>
>> I am new to the list so hello to everyone.....
>>
>> Now for the Windows 7 UAC stuff.
>>
>> 1.) Its beta.... its not going to be perfect wait for RC1 before
>selling 7
>> down the river.
>> 2.)
>> http://www.informationweek.com/news/security/app-
>security/showArticle.jhtml?articleID=213001021&subSection=News
>>
>>                It all comes back to windows biggest issue, joe
>the plumber
>> shouldn't not be running as a local admin on his box. UAC
>problem solved!  I
>> still dont see how redmond missed the concept.
>>
>>
>>
>>
>> On Thu, Feb 5, 2009 at 1:52 PM, Miller Grey
><vigilantgregorius@...il.com>wrote:
>>
>>> ...what?
>>>
>>> On Tue, Feb 3, 2009 at 3:40 PM, M.B.Jr.
><marcio.barbado@...il.com> wrote:
>>>
>>>> Windows says: Hello world! Check this out, world, this is
>really cool.
>>>> Now I have, uh, something like, uh, "privileges management"!
>>>>
>>>>
>>>>
>>>> "UAC" is no more than a new commercial designation for
>something with
>>>> about 40 years.
>>>> And they (Redmond) are still missing the concept's point.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> On Mon, Feb 2, 2009 at 5:14 PM, Christopher Pritchard
>>>> <mailinglist@...iniacghost.co.uk> wrote:
>>>> >> The biggest issue here is that although it's technically
>easy to fix
>>>> >> this problem (just have UAC issue an alert when somebody's
>messing
>>>> with
>>>> >> the system settings), it involves doing more of what end
>users dislike
>>>> >> most about UAC (it issuing alerts to Joe Sixpack all the
>time when he
>>>> >> does something bone-headed security-wise).
>>>> >>
>>>> >> Fixing this one in a way that users will put up with will
>be a bitch.
>>>> >
>>>> > Why not just have it not prompt if you are changing
>settings, except
>>>> for UAC settings? that would be the simple way around it
>>>> >
>>>> > _______________________________________________
>>>> > Full-Disclosure - We believe in it.
>>>> > Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>>>> > Hosted and sponsored by Secunia - http://secunia.com/
>>>> >
>>>>
>>>>
>>>>
>>>> --
>>>> Marcio Barbado, Jr.
>>>>
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>
>>>
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQECAAYFAkmMTvUACgkQi04xwClgpZib+AP9F9nse7R1YZxa1t5lfhxt7ifdsJ2g
AQqj8gU3WRA2jFirU8uSCr0gNms7thdGUr9E47k8Rex2oglcuaThA/UM2CV0q+WRWyRN
l9ufwQu8HhndZA/aNqjdWbubXRRUFB8x0utY2lKFdbFiiqvk7ogztZ96DzK1Ujhf/HKC
IGp3Dlg=
=OLph
-----END PGP SIGNATURE-----

--
Love Graphic Design? Find a school near you. Click Now.
 http://tagline.hushmail.com/fc/PnY6qxunKhUCWeXBZzoDmEq2Rrpr2dhlILwZbiXAUOMw578dWAklS/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/