Re: Question for the Windows pros

[Frank Knobbe <frank () knobbe us>]

On Wed, 2006-01-18 at 16:16 -0600, Paul Schmehl wrote:
> This means that the exposure, when granting the privilege, is as follows:
> 1) If you can launch a process on the local machine AND
> 2) The process has embedded credentials that are different from the user 
> launching the process THEN
> 3) The user gains those credentials' privileges ***for the length of that 
> process***

Yup. So if your use has that right, any spyware the user downloads via
IE can use that user right to elevate credentials **for the length of
the malware installation**. Does that sound right? And does that sound
like something you'd want to happen?

You're caught between a rock and hard spot. You need to install
software, but don't want to give admin rights. So you have to meddle
with user rights in order to install the software, which would leave the
user again vulnerable to "other software" taking advantage of that user
right.

If you give that right, or admin privs, why don't you limit that only to
the duration of the software install? It sounded like you were planning
on granting that user right and leaving it in place. If you only grant
it temporarily, the exposure is not great, imho. (Remember, I've been
liberated from Windows for a couple years now ;)

> So, why did M$ decide to remove this right from the user?  Because it 
> prevents them from installing software on the box.

Right. But now you find yourself having to dish out that right again to
make some software work. What's wrong with that picture? ;)

Cheers,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/