Full Disclosure mailing list archives
Re: MS Windows Screensaver Privilege Escalation
From: Paul Schmehl <pauls () utdallas edu>
Date: Mon, 29 Nov 2004 10:40:11 -0600
--On Sunday, November 28, 2004 09:41:23 PM +1300 Nick FitzGerald <nick () virus-l demon co uk> wrote:
This model breaks down, of course, in the home market, where people want unfettered access to their computer.That's because it is (more than) pretty stupid to let users install software at all. The job of system administrators is to "manage" the systems they are responsible for. With Windows systems that requires that "ordinary users" (i.e. everyone whose job is not officially "system administrator") _MUST NOT_ be allowed to install new software. Sadly, extraordinarily few Windows system admins actually have enough nouse to realize this, and most of the few who do cannot get enough management muscle to back such a "draconian" policy.
What we need is a paradigm shift in thinking about security and computers. We need "users" to be required/forced? to change accounts to install software. Something like a virtual session, so that, when they're logged in, and they decide they want to install something, when they attempt to install, the system forces them into a virtual session, authenticates them as root/admin and performs the install within that session. Once the install completes, the session closes, and they're back to "joe user" again.
People could still override this, but they would (obviously) have to be somewhat knowledgeable to do it. (Really what we need is the unix model, where users can never be admins and admins *should* never be users, but we *all* know that's never going to happen.)
Just last night my 28 year old daughter was complaining about having to update her laptop. She called it "a second job" that she wasn't paid for. She yearns for "automated updates" that she doesn't have to deal with. On a corporate network, that's doable, but at home??? I explained to her why trusting her computer's updates to someone else was a bad thing, but that only made her more knowledgeable, not more happy. :-)
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: [in] MS Windows Screensaver Privilege Escalation, (continued)
- RE: [in] MS Windows Screensaver Privilege Escalation Curt Purdy (Nov 24)
- Re: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 25)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation David Vincent (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Matt Andreko (Nov 27)
- Re: MS Windows Screensaver Privilege Escalation Pavel Kankovsky (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation devis (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation Nick FitzGerald (Nov 28)
- Re: MS Windows Screensaver Privilege Escalation Paul Schmehl (Nov 29)
- RE: MS Windows Screensaver Privilege Escalation Kovács László (Nov 29)
- Re[2]: MS Windows Screensaver Privilege Escalation 3APA3A (Nov 25)