Re: Hacked

From: Karl Levinson, mvp (levinson_k_at_despammed.com)
Date: 03/26/05 

Date: Sat, 26 Mar 2005 07:41:58 -0500

"johnstep" <ai7802@wayne.edu> wrote in message
news:OGQr9YUMFHA.2132@TK2MSFTNGP14.phx.gbl...
> Does a hacker need adminstrative permissions to drop a backdoor program on
> your computer and excute it?

No. A hacker can do most things without administrative privileges. Of
course, most hackers do get administrative privileges... partly because most
people run Windows day to day by logging in with administrator privileges,
partly because most remote network service buffer overflows grant
administrator-equivalent privileges. Also, if you are running as a user
that is in the local Power Users group, it is reportedly not too hard to
escalate your privileges to administrator, if you needed to, so MS and
others recommend not using that group at all if you can help it.

A non-administrator user can still copy and write executable files to your
disk, run those files, see your data files and most of your Windows files
[unless you or your administrator have intentionally changed the ACL
permissions on the files and folders], send email viruses out, run a remote
access Trojan that listens for incoming connections, install hidden software
to use your computer as an FTP server, etc. A non-administrator user
cannnot add or change user accounts, is hindered in being able to get your
SAM database of local users and passwords, and *might* have difficulty
making a malicious program re-load if you log out and a different user ID is
used to log back into your computer.

Running Windows as non-administrator is a good security practice, but
contrary to popular belief, it does NOT hinder most viruses or worms.
Running as non-admin does successfully block most of today's adware and
spyware, but only because adware and spyware authors have no need to try to
write programs that work as non-administrator, because few people do so.

Note that if your hard drive was not formatted as NTFS at the time that
Windows was being installed, then every user on your computer has
permissions to all of the files on your hard drive. If this applies to you,
this can be fixed. I believe the default permissions on all drives besides
your C: drive is also that every user has full permission.

Relevant Pages

  • [Algorythm] Read-write on a shared file
    ... I'm wondering about the algorythm and I was looking for your comments. ... Then let say a hacker in in front of one of the computer that only ... In the file is written read and write permissions for all users (or ... usernameand the public key (it is public, ...
    (comp.os.linux.misc)
  • Re: [Algorythm] Read-write on a shared file
    ... Let say this hacker will try to sniff the ... > there may be a separate file for permissions). ... > because all communications will be SSL encrypted. ... > hacker cannot get) and the public key of the receiver. ...
    (comp.os.linux.misc)
  • Re: Cleaning hacked IIS server
    ... >files that have been posted by a hacker. ... >taking ownership, forcing new permissions, cutting off ... >inheritance and am unable to move or delete the files. ... NTFS and folder permissions ...
    (microsoft.public.inetserver.iis.security)
  • Re: CACLS
    ... Would "cacls /t /g user:F" help? ... any user with administrative privileges on the machine could ... take ownership of the file and reset the permissions. ... > the administrator could access my folder, and i want only my special user ...
    (microsoft.public.win2000.cmdprompt.admin)
  • Cleaning hacked IIS server
    ... I have an IIS server that has thousands of folders and ... files that have been posted by a hacker. ... taking ownership, forcing new permissions, cutting off ...
    (microsoft.public.inetserver.iis.security)