Re: New IE flaw and exploit sites/migration to non-MS browser

IE version 1 .. and what was the threat model at that time? Folks on 9600 baud modems and the Melissa virus?

Any current Microsoft product with the XP logo has to run as LUA these days.

If there are software from MS in violation (especially anything new) please nominate them to www.threatcode.com. Give specific examples.

You should see the logo requirements for Vista.. I strongly predict that admins/users will take time to get used to Vista's "non admin" dialog boxes. It will annoy the heck out of them first.

2003 I only log into that box when I need to administer it as an admin... say installing patches... it's got that Enchance IE security ... I don't use that server OS ever in the same context as a "local administrator". I log in with domain admin equivalent rights, do my maintenance and log off. Otherwise users have appropriate rights on that server (certainly not admin rights)

No...the vendor needs to code appropriately. This isn't 1998 and we're running modern software.

The "it's too hard" won't cut it anymore. Yell at the vendor..and I'm not talking Microsoft here... google on LUA instructions (there's many community resources starting out there) and most of the time... if I don't tell the user in my office they don't have admin rights... they don't know they don't have them anymore.

http://blogs.msdn.com/aaron_margosis/

Devin Ganger wrote:

At Friday, March 31, 2006 3:08 PM, Susan Bradley, CPA aka Ebitz - SBS
Rocks [MVP] wrote:



Is it IE that's insecure? Or how the workstations are setup in the
first place?



Both. I remember back to using IE version 1 and having to maintain web
developer desktops with multiple versions of IE and Netscape. IE/Windows
has always had more insecure defaults, more bugs and vulnerabilities,
and caused more problems than any of the other browsers.

In hindsight, Windows 2000/XP/2003 should never have been released while
effectively requiring users to be local admins on the box (and despite
what the official guidelines say, there are too many cases of even
Microsoft software assuming that you're local admin to hide the fact
that these platforms have NOT been designed with LUA in mind).

This problem bites the users of any browser, and adjusting current
versions of Windows to run LUA is difficult, frustrating, and expensive
in time. A lot of smaller companies just don't have the time or
knowledgeable resources to do it properly -- and the OS should be doing
it for them.




--
Letting your vendors set your risk analysis these days? http://www.threatcode.com


---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • RE: How does XP SP2 improve security for user
    ... to work on your machine only with admin rights. ... Therefore it is a lot better to use a normal user account for your daytime ... > Microsoft assumes that all users are having Users rights? ...
    (microsoft.public.windowsxp.general)
  • Re: Windows XP update
    ... Windows Update to work. ... What else is new at Microsoft, ... > rights. ...
    (microsoft.public.windowsupdate)
  • Re: Should I still buy SBS 2003 Premium w/ ISA in light of XP SP2s ICF2?
    ... Admin rights is a very simple story. ... relying upon the firewall to block accordingly the access to workstations, ... don't have the same level of packet-filtering in your favor that ISA ...
    (microsoft.public.windows.server.sbs)
  • Re: Randy
    ... This posting is provided "AS-IS" with no warranties or guarantees and confers no rights. ... Microsoft MVP - Directory Services ... it is best practice design to create an empty place holder root domain to ... hold the enterprise admin group and to hold the forest schema operations ...
    (microsoft.public.windows.server.active_directory)
  • RE: Impact of removing administrative rights in an enterprise running XP
    ... While it is true that you can push out patches and software via group ... reporting mechanisms for software/patch installations whatsoever. ... Quite often, the admin rights are ...
    (Focus-Microsoft)