RSSWindows 7's ability to selectively elevate privileges is under scrutiny
By Scott M. Fulton, III | Published February 4, 2009, 8:02 PM
In Microsoft's ongoing effort to alleviate users' discomfort with Windows Vista's security nags, the company may be re-introducing a potential powder keg of new problems, as researchers continue to discover.
In his continuing investigation of the UAC bypasses being tested for Windows 7, developer Rafael Rivera points out another potentially serious problem: As developer Leo Davidson noted in a recent blog post, some binaries in Windows 7 are given the ability to present XML-based manifests of themselves that give themselves a privilege called autoelevate.
It does exactly what it sounds like it does. Now, in Vista itself, auto-elevation has also been possible, but on a very broad scale only. For example, it's technically possible for User Account Control to suppress all prompts to anyone logged in as an administrator; in fact, a freeware tool for just this purpose has been available since 2007. However, in Win7, an XML-based tag enables this privilege to be extended to individual programs.
Though online community support personnel may not always have direct communication with Microsoft engineers, an explanation given by support personnel member Jialiang Ge last month regarding a question a Win7 tester had after discovering this feature, is being dissected today by Rivera and others. Here is the section in question:
The change we made in Windows 7 default UAC settings is that any operation that is necessary to manage windows will not require an elevation - which in technical terms translates into a white list of trusted action / binaries which the user can make perform without UAC prompting from an elevation. This list does include windows file operations.
You see a prompt in your File Manager program because your binary is not an inbox binary - i.e. not an executable which ships with windows. Hope that explains and clarifies. For security considerations, Windows 7 does not allow any 3rd party binary to be in the Windows trusted list. Therefore, your File Manager program still needs to handle the elevations.
As Ge described it, although a white list does not physically exist, the list of all binaries whose autoelevate tag is engaged may as well be a whitelist. And while Microsoft has asserted that only Windows gets to decide which binaries belong to the whitelist -- or, more specifically, that the privilege of assigning the tag has been assigned only to Windows -- an example of a Windows binary that is frequently used by third-party utilities just to run (ever since Windows 3.0, in fact) has been RUNDLL32.EXE.
While this alone is not evidence of a potential security hole in the current Windows 7 beta, it can point to where such a hole is likely to develop. It all depends on how Microsoft chooses to treat the Windows binaries that can be shared by other applications produced outside of Microsoft.
Historically, components of Microsoft's Component Object Model, in use since the days of Windows/386, suffered from their inherent implicit trust in one another. That non-questioning attitude was what led to some of the original ActiveX security holes that led to the widespread discrediting of that technology.
This has now been fixed - http://www.neowin.net/ne...c-behavior-in-windows-7
Score: 0
|This is more thoughts about why you need TWO versions of Windows 7.
Windows 7 Home
Windows 7 Business
Home has all the multimedia goodies, but none of the "host web pages / connect to huge corporate networks" type of stuff. Option right at the install asking "How secure do you want to be today?":
- Option 1: Simple file and printer sharing, no passwords required, fully functional internet / ftp access enabled, no in-network firewall blocking, choice of single user or multi user configuration.
- Option 2: Protect me from the world, I have no idea of the horrors facing me out there in the IntarWebZ, Blockade and Panic Room me please.
Business has a lean, clean install that is locked down by default and can be extended modularly to include any features available, but as a separate install. You have a Media Player 6.4 kind of thing with limited codec support - No DirectX, no gaming features, and Media Center, DVD Maker and all the "fluff" is not included by default.
There ya go. How freakin' cool would THAT be?
:-)
Score: 0
|UAC, and activation were a big mistake from the beginning and a total waste of resources and money since they really only ever affect the legit user and not those who aren't. Anyone who defends them is an idiot. What good is security that only keeps the legal owner out?
Score: -3
|"What good is security that only keeps the legal owner out?"
UAC keeps the legal owner out?
Cute...
I suppose requiring a login at *all* is a problem for you, eh?
What you ignore (I believe purposefully) is that after initial configuration, UAC rarely even shows it's face *unless* you run a lot of programs that are *not* Vista (UAC) ready *or* are an IT admin.
If it is #1, and your programs are not UAC ready, complain to the devs. All common programs should be able to operate just fine without prompting UAC... Sadly, there are still quite a few out there who, even after several post-vista updates, aren't getting it. Like you, they blame Vista...and not a simply change they could make to the installation routine that would stop the program from prompting a UAC dialog.
If it is #2...well, you're an admin. Get used to it. Supposedly, security is one of your biggest concerns...
But for you, I am guessing it's #3. You are whining simply because it's MSFT and you simply don't know any better. [smiles]
Score: 1
|MS can never win. No matter what they do, it will always be wrong in the eyes of their detractors. Too much or not enough. Whatever.
Score: 4
|Too right.
"Wahh...UAC is too annoying!"
To:
"Wahhh....I set UAC to not be too annoying and now scripts can wreak havok on my computer!"
Of course, their all playing the "victim". Microsoft did this to them.
*laughing*
Set UAC to the max and be done with it. The few prompts you will get after initial configuration is well worth it.
Score: 2
|Always the Tool.
Score: -2
|...always the troll. [rollseyes]
Score: 1
|More like .. if Microsoft designed its os right since win95 or even earlier as best practices had demonstrated for a long time, he would not have to retrofit such proper design into the os and break programs or annoy the user endlessly with generic and nearly meaningless prompt .. Ever tried to navigate in secure mode in IE (the one that is on by default on windows server 2008 for instance) ? so secure you can't see a page without a meaningless prompt. (do you really want to see this page that I don't know if I can render without a compromising bug blowing away my security ask the crazy I.E to the poor user )
Mac for another mainstream GUI oriented OS and Unixes, did not have these problems at all because best software practices and application design were built it from the start ...
Can we at least recognize that ?
Score: 1
|We can recognize that in order to do that, they would have had to sacrifice compatibility with the existing 16-bit apps that Microsoft so desperately needed to support to gain any support for a 32-bit OS in the consumer market. Virtualization wasn't an option then, and any other route would have had a major impact on performance.
Sure, we can argue that compatibility can (and likely should) be handled differently now, and it looks like they may go that route int he next platform release, but there were enough compatibility issues in this current platform to argue against further changes at this point.
This is not a troll... You made a good point. I'm simply sharing my view of it.
Score: 0
|Wot? This "auto-evelate" via XML manifests has been around since Vista. It's not a new thing at all. Silly article.
http://blogs.msdn.com/ni...n-elevate-in-vista.aspx
http://www.restuner.com/...trust-info-manifest.htm
http://www.vistaheads.co...tion-advice-needed.html
Score: 1
|Sounds like a feature to me.
Score: 0
|it is something Microsoft needs to address, and we are talking about a beta here so i'm not going to jump all over it, but like i've said before... many, many people said hey MS, we want control back, we can pick and choose whats safe for our PC's ... MS as it stands right now said, alright, the consumer is always right i guess and have tried to work this out in the least annoying manner, but you really can't have more security with less annoyances now can you, although i do think MS could come up with a better solution ie) require password entry when any aspect of UAC setting is changed manually or automated.
i can't really blame MS for this little mishap, i blame everyone who cried fowl really, and what i've said all along still stands, Vistas UAC is not that bad.
all that said, i'd still like to see MS look into this, fix what needs to be fixed and move on from UAC, my bet is if you talked to whoever works on UAC they would say yeah, we could improve it somewhat, while they probably need permission to change whats already been done and have folks in their ear saying you're not touching a thing right now
Score: 3
|I agree, art.
As I have mentioned previously - it's really a MS curse. They are damned if they do, and damned if they don't.
People want completely transparent, unobtrusive integrated OS protection/security and that's just not reasonable for an OS that is expected to and pretty much does run the majority of hardware and software out there.
UAC was never that horrible. Annoying? Sure. Horrible? No. Can they make it better? Possibly - and they're trying. They're obviously listening to user suggestions concerning features....but of course there's still negative yap simply because MS makes it.
Score: 1
|PC_Tool blind zealotry in 3, 2, 1..
(or maybe not, you never know)
Score: -6
|Bah...blind zealotry is iTard7. If I was blind, I'd like IE, use "Live", and MSN. As it is, I can't stand those. :) (I just don't go into every topic concerning them and rant like an idiot about a product I supposedly couldn't care less about)
...and I'm not too fond of Vista's release. ;)
That said, I will defend anyone against stupid, baseless, and absurd accusations (or at least try and explain the logic behind it to those who can't see it through their troll-colored glasses).
...or I could just be a complete jerk.
...you never know... ;)
Score: 1
|More like he's a corporate w.h.o.r.e. instead. Here's a quarter, reply..... [smiles]
Score: -3
|Hey, pup. Missed ya. Glad to see you back, nipping at my heels. Please try not to ruin the floors, though...(it'd be so nice if they came house trained)
Score: 1
|I have to disagree but you are entitled to your opinion. PC seems the most tech knowledgeable posting here and while I sometimes disagree, I respect his knowledge and he seems even-handed.
Having said that, I have not used 7 because I always wait until it is officially released and the 1st sp1 comes out. Right now I am using Vista Home prem. 64 bit. I use a solid AV, FF (software and hardware), and 2 antispyware programs that I like. I have also turned off UAC and guess what? No problems. I have run all the above and defender and even some online scans and nothing has been found. I also use common sense in where I go online. All programs are kept up to date. so, from my perspective, I don't see the need for UAC period.
if you don't use a decent AV,FF, and spyware and keep them up to date AND run them AND go to questionable sites then you are asking for problems UAC or not.
A lot of Posters here may have more knowledge than me but that has been my experience. Now when 7 is officially released and sp1 comes out, I may feel differently but that would be because there are more problems with 7 than just UAC. It seems that if MS takes the best of the current Vista and adds some under the hood changes in 7 then I still feel that UAC is not needed.
One final point- Different environments may require a different approach. My approach works for me but not necessarily in other settings.
Just my humble opinion.
Everyone Have a nice day:)
Score: 1
|