Re: possible regedit bulk key deletion vulnerability (Revised)

From: k levinson (levinson_k_at_YAHOO.COM)
Date: 11/16/04

  • Next message: Ron Parker: "Re: possible regedit bulk key deletion vulnerability (Revised)" 
    Date:         Tue, 16 Nov 2004 07:03:12 -0800
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    I'm sorry, but I must beg to differ.

    Only Administrators and System have permission to the
    root of HKLM. Administrators, and malware run by
    administrator, can do pretty much anything to the
    system. Anything you can do to inhibit
    administrators, another admin can undo.

    As the old saying goes, "garbage in, garbage out."
    Since the OS is basically there to do what the user
    tells it to do, there is only so much the OS can do to
    protect you from yourself. Note that global deletion
    of important system files and objects is a problem for
    all OSes and is not a Microsoft-only issue.

    Microsoft has given you two ways to help protect
    against this: have your users log in as
    non-administrator [I know, there are some issues
    around this], and back up your registry from time to
    time, especially before making changes to the
    Registry. The latter is mentioned in every MS KB
    article involving registry edits. The third way
    around this is to test any new changes on one system
    first, but there's little Microsoft can do to force
    you to do this.

    If you're truly worried about what malware run by your
    users can do, there's little you or Microsoft can do
    about this until you have your users log in as
    non-administrators. Your suggestion to lock away
    regedit [which is not the only safeguard, by the way]
    won't really work in your situation, unless you deny
    Administrators the ability to run Regedit, which is
    probably not a very good idea.

    kind regards,

    karl levinson

    __________________________________
    Do you Yahoo!?
    The all-new My Yahoo! - Get yours free!
    http://my.yahoo.com 

    --
Editor's Note: The 43rd Most Powerful Person in Networking says...
Register today to take the TruSecure ICSA exam by 12/31/04  at
<http://www.2test.com> ,  use promo code "CT1204" and you will pay just
$221.25 US Dollars for domestic exam delivery and  $296.25 US Dollars
for international delivery.
Visit <https://ticsa.trusecure.com>  for complete details regarding the
TICSA credential and to take the free sample exam.
--
  • Next message: Ron Parker: "Re: possible regedit bulk key deletion vulnerability (Revised)"

    Relevant Pages

    • Re: [Full-disclosure] Steve Gibson smokes crack?
      ... about the bug for a long time and made a concious decision not to patch it even though they knew it could lead to a system compromise. ... People commented on how Microsoft put out a patch quicker than they ... This is their history going back to before they purchased IE, and something that became really evident when they first began rebuilding Mosaic. ... When NT came out and Microsoft moved from producing OS' that were not network ready out of the box and toy-like GUI infrastructures, the impacts of that strategy were transposed onto administrators and users alike. ...
      (Full-Disclosure)
    • Re: [Full-disclosure] Steve Gibson smokes crack?
      ... I wasn't agreeing its a conspiracy I was just saying they knew about ... but its hard to when we find out Microsoft knew ... > their history going back to before they purchased IE, ... > strategy were transposed onto administrators and users (now more ...
      (Full-Disclosure)
    • Re: Two DB Owners
      ... impede Microsoft Windows NT system administrators from having system ... I'd like to remove all permissions from the admins ... When I remove the login it doesn't ...
      (microsoft.public.sqlserver.security)
    • Re: desk top restirction
      ... Take a look at the free Shared Computer Toolkit from Microsoft. ... SP2 but is good at creating restricted users while not interfering with ... local Group Policy you also can try giving administrators deny permissions ... you can populate their user profile folders for desktop and start menu to ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Updates
      ... I'm not the Michael Waltrip who drives fast and turns ... >If I change the policy to allow "Take Ownership of files ... >objects" for administrators everything works fine. ... >these updates to work Microsoft must do something to fix ...
      (microsoft.public.windowsupdate)