Slashdot Mirror

The loa (acoustic waves laboratory) in Paris is doing such intra skull focusing for years.
List of related papers:
http://www.loa.espci.fr/cgi-bin/papiers?lang=en
especially #37 #46 #49 #64 and #65

PsExec can start a new process as admin with the password on the command line.
SU/SUD is a more flexible program, including a setuid equivalent function.
Also, SFU can launch Win32 processes as different users with su and can also do setuid.

So why isn't it properly configured out of the box? Other systems are. Why not Windows (pre SP2)?

A computer is a commodity, to be used by a variety of users, where only a little part of them are capable of 'brak the shell into little unpriviliged sandboxes'. I know that I'm not.

No, it is not. There are Windows users with 50% more IQ than you or me, yet they still get pwned.

Windows is a tool of necessity. I have to use Windows at work, since it is all that is offered. I bitch and complain a lot abou this and get heard only a little. So I'm stuck with it.

Non-root users and software can't screw up your system (short of using a root exploit, and that generally requires malicious intent) so as soon as your child is done, (s)he logs out, you log in, and all your stuff is as you left it.

I'm glad modern linux distros automatically prompt for the root password when needed.

As far as I'm concerned (on the windows side), having to open the entire shell (explorer) as admin in order to run a certain program (e.g., control panel) seems like bad design.

I would at least like to see the commandline version of runas work as well as su does in linux.

Many applications and games require admin privileges to install. Windows Update requires admin privileges. etc etc.

Compare that to the Millions of Windows machines completely infected with spyware right now because Microsoft has no clue how to secure a web browser.

But combine users running by default as Admin [...]

I've been running my Windows computers without a firewall (other than a NAT router), virus scanner, spyware protection, only patching at service packs without any problems. I've never had a worm, virus, trojan or other infection. I've never reinstalled Windows, and no, it doesn't get slow.

How do I do it?
1. I log on as a normal user (not admin). This is the single best defense against crapware. For installation and those whiney apps that require admin access, I use the Windows equivalent of sudo transparently to launch them. I also run IE and OE as a seperate limited user that doesn't have access to anything important (like documents).
2. The NAT router protects me from all incoming worms/unsolicited traffic.
3. I use Mozilla instead of IE.
4. I know what I am doing: I don't run crapware/virus infected stuff.

The first two items are sufficent to protect you from mostly everything. My brother got some crap installed; after cleaning it up, I instituted the first one and he has been clear ever since (more than a year).

Overrunning a web browser, including Internet Explorer, won't get you root access unless you are running it in a privledged account such as Administrator. IE is just another user mode program.

There are tools available, such as runas, SUD, and psexec that let you run only specific programs (usually those that need admin access for no reason) as admin.

For protecting the system from malicious users who know what they are doing, it would in fact be useless.

For protecting yourself against crapware and IE's holes, it is very useful; a malicious program would have to be pretty intelligent to search for scripts with passwords.
Yeah, it's security through obscurity but it has very little chance of failing; most (everything I've seen) Windows crapware just expects to have access already or fails.
Plus, su/sud lets you create a key file that only lets you start one program as one user(without knowing the password); it has similar uses to setuid.

I'd say it's about as secure and useful as giving someone sudo access on UNIX.

I don't know why it isn't working. This may be a stupid question, but are you sure the SecondaryLogon service is running? Maybe explorer is quitting for some reason; try starting another cmd.
The user is really named Admin.
Did you try SUD/SU? I always use that instead of RunAs anymore.
Also, see psexec. It can do the same thing, and it can also do it on remote computers (assuming you have access).

Hell, when Administrative priv. are required, what does Windows software do? It pops up, "You have to be running as an Administrator to ...". It doesn't even ask you for Admin. password to complete its function. You just have to relogin. And thanks to the great "multi user capabilities", you have to log out of your current session first.

Hell, when Administrative priv. are required, what does Windows software do? It pops up, "You have to be running as an Administrator to ...". It doesn't even ask you for Admin. password to complete its function. You just have to relogin. And thanks to the great "multi user capabilities", you have to log out of your current session first.

I just tried "runas /u:Admin explorer". It promted me for a password, and then created a new explorer process running as the user Admin. It worked from xpsp1 and 2ksp3. You could also start a command prompt and run explorer from there.

I don't like runas becuase you can't use it for setuid or make the password a command line parameter. Here is a tool that does that.

Download tools from SysInternals.
Autoruns will list everything that gets started. Check that out for unnecessary entries.
Process explorer will show all running processes and exactly where cpu time is spent, down to the thread, with stack information.
Filemon can show all disk activity down to the lowest level; even writes to the file table.
There are many others, try them out.

As for stuff that already comes with Windows:
Look at the Event Viewer; what is causing the crashes? Is it a specific driver that could be replaced/upgraded? Include bus drivers listed under system devices. Ignore driver signing; there are bad signed drivers and good unsigned drivers out there. Generic drivers will be more stable but might be slower.
In XP, run verifier.exe to run some extra checks on drivers (restart requried) to help identify problems. Using the checked build of the kernel can also be quite useful, if you know any kernel debugging. If possible, buy hardware from vendors that write quality drivers. (sounds like Linux; buy hardware for the software support.)

Run spybot/adaware to rid the computer of spyware, and institute protection from future infection by running IE and the shell as a lesser user. Runas, psexec, and SUD can help with this.

Otherwise, try to figure out when and how the computer is slow. Is the hard drive running all the time? Mabye the computer is low on memory and it's time to stop some unnecessary services? Is it CPU usage caused by some rogue process that you can track down with Process Explorer?

Erm, yes they do, at least under NT 4.0 Workstation and 2000 Professional with default settings.

True, although it stops a lot of standard software from working, including the drivers for my scanner. Funnily enough, I don't want to have to log in as administrator to use my scanner.

Good post. The culture differences between Windows and UNIX are just like you said. I wish MS would crack down on ignorant developers too, but it really isn't their job; the users should be complaining more. Microsoft's own software is usually pretty good about it. Games are the worst.
UNIX has commands like su to run programs that require extra priveledges. Windows has runas, psexec, and sud.When I find something that doesn't behave as a lesser user, I create a simple shortcut that uses sud to start that one program as admin or some user with just enough access. It's not perfect but it works.

Now, if Windows had some form of sudo or setuid, that might actually work.

[...]I much prefer the way OS X handles it, in that you never "log in" as administrator, instead you just temporarily give privilege to one process when installing software or changing system settings. In most UNIX systems, you never log into the GUI as root. Because of this design in OS X, it pretty much forces apps to behave properly, and even casual users will usually understand that having to type in their password meens "something important is happening".

Out in the Real World, machines are typically used by one person. The only files on that machine, or accessible via the network, that person (and their boss) cares about, are the ones they spend all of their time working on and any virus running as them will have full access to.

Here's what you do about badly written programs that require too many priveleges: Create a runas script to run only those programs as admin. Like sudo in unix. Or the tool SUD from http://www.loa.espci.fr/winnt/sud/sud.htm. A proper su command for WinNT.
Along the same lines, locking down IE and OE with a seperate restricted user is a good idea too.

su -u Admin -p 123 -c %1
exit

This is some hope, however, in accomplishing this in time-varying scattering/refractive/wave-prop environments (albeit at different ratios of carrier wavelengths to characteristic-length-of-scatterer). The medical ultrasonics people do essentially the same thing to accoustically destroy kidney-stones in-vivo. Matthias Fink, who is quoted towards the tail end of the NS article, is heavily involved in that work (along with his research group), and has published extensively.

(ObSlamDot: My gosh! An actual rational scientific discussion on SlashDot, where actual factual information is exchanged! We can't have that! Quick! Someone post a flame! ;-)