Re: [Full-disclosure] Question for the Windows pros



On Wed, 2006-01-18 at 16:16 -0600, Paul Schmehl wrote:
> This means that the exposure, when granting the privilege, is as follows:
> 1) If you can launch a process on the local machine AND
> 2) The process has embedded credentials that are different from the user
> launching the process THEN
> 3) The user gains those credentials' privileges ***for the length of that
> process***

Yup. So if your use has that right, any spyware the user downloads via
IE can use that user right to elevate credentials **for the length of
the malware installation**. Does that sound right? And does that sound
like something you'd want to happen?

You're caught between a rock and hard spot. You need to install
software, but don't want to give admin rights. So you have to meddle
with user rights in order to install the software, which would leave the
user again vulnerable to "other software" taking advantage of that user
right.

If you give that right, or admin privs, why don't you limit that only to
the duration of the software install? It sounded like you were planning
on granting that user right and leaving it in place. If you only grant
it temporarily, the exposure is not great, imho. (Remember, I've been
liberated from Windows for a couple years now ;)

> So, why did M$ decide to remove this right from the user? Because it
> prevents them from installing software on the box.

Right. But now you find yourself having to dish out that right again to
make some software work. What's wrong with that picture? ;)

Cheers,
Frank

--
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Attachment:signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Relevant Pages

  • Re: XP and netlogon script privilages
    ... I looked into Power Users, but even on some of the basic packages we use, they complained about Admin rights then failed to install. ... Hence I've stuck with the logon scripts which I can control to the n'th degree. ... Group Policy Software Deployment Background: ...
    (microsoft.public.windows.server.general)
  • Re: XP and netlogon script privilages
    ... they complained about Admin rights then failed to install. ... This seems a crappy way of giving users local admin rights. ... Most of my deployment applications work via Netlogon scripts. ... Group Policy Software Deployment Background: ...
    (microsoft.public.windows.server.general)
  • Yosemite hot CPU problem
    ... I ran into a performance problem with my test install of Yosemite. ... No clues for the other busy daemons, ... A friend had upgraded to Yosemite on launch day and happened to mention ...
    (comp.sys.mac.system)
  • Re: File Summary/ Knowing when a file is created and deleted/ The first program started when windows
    ... > when some program adds files before the windows UI is launched. ... > There are programs that install upon reboot of Windows and before other ... it needs to launch before any other program. ... > Monitor Program would launch and ...
    (microsoft.public.vc.mfc)
  • Re: Problems reinstalling Office 2004 G4 PowerPC
    ... Reinstalling rarely fixes issues like you mentioned. ... Combo updaters will install on the same ... Backup your Documents folder. ... launch Word or any other Office app all I got was a flash of the name on the ...
    (microsoft.public.mac.office)