Slashdot Mirror
"Very Severe Hole" In Vista UAC Design
Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."
There's a much, much bigger hole than any programmer could possibly exploit: The annoyance factor.
Last night, I restored my old XP partition after figuring I'd give Vista a shot for just a couple of days. You know, just to experience it myself instead of taking other people's word for what it's like.
The theme of Vista seems to be simple: Annoy the hell out of he end user. You want to run an application, is that okay? You want to copy a file, is that okay? You want to change your desktop background, is that okay? You want to copy text from IE7, is that okay? You want to delete an old text file, is that okay? You want to paste text into a form field in IE7, is that okay? The list goes on and on. Almost every action in Vista is actually compose of two separate actions: the one you want to do, and the confirmation to do it.
After getting Windows Vista installed, I took an hour or so to configure my personal settings and install a couple of applications. I had to acknowledge somewhere between 50 and 100 dialog boxes asking me if it was okay to do what I was doing. No, I'm not exaggerating.
Now, I'm a very experienced computer user, and I've worked for over a decade supporting PCs, servers, networks, and so on. Yes, I know, I could disable UAC if I want to, but that kind of defeats the point of Vista's so-called beefed up security.
Even I became so numb to clicking OK in two short days that I wouldn't think twice about it. You want to move that shortcut on your start menu, is that okay? You want to install the Pwnzjoo virus, is that okay? You want to send your bank account numbers to Nigeria, is that okay? Yes, yes, yes, dammit!
If Microsoft wants to really get serious about security, they have to get it through their heads that it's not about locking everything down and popping up prompt after prompt after prompt to the user. It's about being smart, letting the user do normal things without interference or interruption, and having the level of alerts match the danger of what's being done.
As it is, Vista cries wolf so often that when the real wolves show up, I'd be surprised if any user, newbie or guru, listens.
...that security needs to be designed in from the start to be effective, not a bolted-on afterthought.
When are they finally gonna give up this retarded backward-compatibility-at-all-costs mindset and *really* rewrite Windows from the ground up? Microsoft owns Virtual PC for Christ's sake, so it's not like they couldn't include a sandboxed "classic" Windows for app compatibility for a few years.
The one thing Apple did that Microsoft really ought to copy, they don't. Figures.
I think you're right. Microsoft has failed to appreciate the user psychology of interacting with authorization prompts in a way that would shame most retarded chimpanzees. The only explanation that doesn't invoke something more bizarre than Xenu is that they figured most Deltas would simply turn off the feature out of annoyance, and thus Microsoft would bear no blame in the subsequent (and likely rapid) zombification of said Delta's system.
"What? We put the thingy in. It's not our fault if idiotsticks turns it off because he's too lazy to take security seriously."
This is a way to let themselves off the hook, escalating user error to the root of all evil instead of, say, a hopelessly fractured and bloated development bureaucracy overseen by demented lizard people. This is a response to the criticisms about Windows having a default configuration more favourable to trojans than users, so they can now claim that the default configuration is solid. You changed a setting? The buck stops at you, sucker.
Maybe Microsoft needs someone with some insight into user behaviour and interface psychology on staff. I hear Steve Jobs has a reasonable hourly rate. (/me ducks)
These stories are free but worth money.
rpm itself doesn't require root authority, and if everything you intend to do with rpm happens in directories to which you have write authority, rpm will work just fine.
By default, rpm does use directories (notably, in /var) which will require running with root authority; but this can be overridden with command line switches (say, to install an rpm which will only be used by you).
RTFM.
Microsoft has created a culture of choosing between security/good/whatever and 'ease of use'. Going all the way back to older versions of Windows in which there was no user permissions model.
Hearing that all frigging installers are going to want admin perms is a frigging joke. Part of the reason Windows is insecure is you can't do anything without being an admin. It's not like it even supports a model whereby you install the software into your own location. Every piece of software expects to be able to write registries, replace system DLLs, and generally crap into a few common folders.
I mean, well over a decade I could download any old UNIX software, untar it, set an environent variable, and just run the damned software. No root perms needed, just glorious, easy to run/trivial to uninstall software.
This means that people aren't going to install their animated cursors in a sandbox which only affects them. They'll do it as admin, and potentially bork the whole machine.
This just makes me laugh.
Cheers
Lost at C:>. Found at C.
There are 2 ways to install software.
1. Drag application folder where ever you want it
2. If application does need to install a control panel, kext, or any other system file, then you can create an installer. When the installer tries to install the files that need the elevated permissions, it then tells you what it is trying to do and asks for an admin user/password
How is that hard to grasp at MS? Assuming everything needs admin permissions is just insane, and insisting it isn't a security hole and is a "design choice" is just fucking retarded.
today is spelling optional day.
So, this is *exactly* like the latest "get a Mac" ad. Maybe even funnier!
Pumbaa! I don't wonder; I know.
Its mostly because Windows has been so piss-poor with their default settings in the past, so trying to get a more secure-by-default setup is like pulling teeth. I remember once reading in a security book that integrating security into your application after the fact is several times harder than designing it that way by default. Windows is in the unenviable position of having to integrate security after the fact.
Regardless, I think that a Windows version of sudo is a very good step. They just should have spent more time working on permissions so that it didn't trigger so much (assuming that what the posters' have said is accurate). The setup thing in TFA is kinda stupid, but installers almost always write to Program Files in Windows, and rarely have a per-user installation method like in Linux. A better solution would have been to try and encourage installers to have a per-user installation method.
Anyways, it may be that I'm just lucky that I haven't had a lot of problems with UAC. But I haven't had to go registry diving or modify any system directories in Vista yet, so theres that too.
Is it sad or scary when hyperbolic advertising isn't?
My blog. Good stuff (when I remember to update it). Read it.
Everyone who complains that UAC is annoying doesn't understand that the purpose of UAC is to be annoying. UAC makes elevation a pain, in the hope that software creators will write software which doesn't need to elevate!
VMWare 6, for example, constantly elevates on Vista. What do you want to bet that VMWare 7 won't?
Well behaved programs elevate only when and where they have to. Even if 50% of Vista users turn UAC off, that's still 50% of your client base who is being constantly bombarded by elevation dialogs. The solution? Write your software so it doesn't need to elevate.
As for the article - installers pretty much have to elevate. This is true on Windows and with Linux packages (when was the last time you ran apt-get without using sudo or running as root?). Some have pointed out that you can install most packages in Linux to be specific to your user account, using special flags. This, of course, is possible in Vista as well, if MSI packages are used.
Note that I do agree that it's a problem that you can't override UAC detection. There needs to be a "don't run as administrator" option.
The better solution is what OS X does: extend "sudo" to the GUI. The first time the app needs escalated privileges, prompt for the user's password. Then, cache those privileges for a reasonable amount of time and don't prompt. Unless the app in question is compromised in that interval, it doesn't matter.
The problem with UAC is that it fails to separate the two orthogonal issues of sanity-checking the user's behavior, and maintaining system security. Consider how "Program Files" is handled. Browsing into "Program Files" throws up a UAC alert. It shouldn't do that --- "Program Files" is readable to everyone. Writing to "Program Files" should throw up a UAC alert, but only the first time in the caching period. The question at that point isn't "Do you really want to modify this directory" (of course I do!), but rather "Do you want to give Explorer.exe permission to modify this directory". When you follow the first train of thought, you end up with prompting the user each time, because obviously each copy requires a separate sanity-check. If you follow the second train of thought, you see that the caching mechanism is just fine, since if Explorer.exe was authorized 30 seconds ago, it's unlikely it was compromised since then, and should retain that authorization.
A deep unwavering belief is a sure sign you're missing something...
In reality, the hardware is optimized for speed. That is, the core will execute the instructions it receives without any sort of bounds checking. If an instruction fails, then an error code is stored and the next instruction is fetched and executed. It's only during boot time that a kernel has the opportunity to install code at particular vectors to prevent other code from sitting there. That's the PC architecture -- it was designed years ago and for good or bad, we're stuck with it (Ironically, many people make the same argument about Microsoft). That's why the kernel is so important: if it fails to protect a particular interrupt vector or other system integration point, then a userland program can elevate itself to kernel-level privileges and walk all over both the running OS and the data on your hard drives.
The only way to implement your idea (and many others like it) would be to have the hardware recognize this "code source" (or whatever magic bullet you have defined) and act accordingly.
Long story short, people are looking for a technological solution to a lack of education. Like it or not, there's a lot of people on the Internet now that need education. Vista's UAC seems to be along those lines, though extremely insulting and inflexible to an advanced user. It's like it was designed to "raise awareness" of "potentially unsafe operations" so that someone who was previously a clueless idiot can now see that many operations are potentially unsafe. Of course, the prompts don't explain WHY to this person, which eliminates UAC even as an education tool.
"Please describe the scientific nature of the 'whammy'" - Agent Scully
If you cached the elevated credentials authorization for "X" minutes, or whatever, you would be giving a free pass to any malware that happened to be trying to do something bad. That's an incredibly bad solution. But I have to assume that's not what you're suggesting. Browsing into "Program Files" throws up a UAC alert. No, it doesn't. By default, all users on the system can read files in c:\Program Files. Writing to "Program Files" should throw up a UAC alert, but only the first time in the caching period. It does throw up a UAC, but I've already explained why the "caching period" is a bad idea. Now, what might be a good idea is running explorer.exe elevated when you need to perform lots of different file operations that require admin privs. And you can easily do that. If you follow the second train of thought, you see that the caching mechanism is just fine, since if Explorer.exe was authorized 30 seconds ago, it's unlikely it was compromised since then, and should retain that authorization. Ok, I think I see where the confusion is. Explorer is unique in the sense that when you authorize a file operation via UAC it doesn't elevate the entire explorer process. There are a bunch of reasons for this. You *can* elevate the entire explorer process if you want, which will achieve what you're looking to do.
That make sense?
1) So, all Vista installers run with admin. priv.
2) Installing a downloaded Tetris game allows the game installer to change virtually anything in the system.
Why does a game need an installer at all ? Why not just unzip the game into your user account/home directory or better yet drag the game icon to the place you want it ? Why do Windows applications all seem to need an installer ?
On OS X and NeXTstep before it, application icons are actually covers for directories containing all of the support files including executables need by the application. Furthermore, applications are not supposed to assume that they can write to their own directory. This is convenient for running applications from servers without installing on the local machine or for running directly off a CD-ROM. If an application needs to store user data or write configuration files, there are standard places to put the files. When needed, the individual application copies files to standard places using the user's permissions and not admin permissions.
The first time any application is run, the user is asked if it is OK. If some crap is downloaded and executed unintentionally, the user is given a chance to say WTF and stop it. Any time any application needs privileges beyond the user's default privileges, an admin passwd is required.
No installers (except in crap-ware and unusual circumstances and even then they require an admin password for upgraded privileges!
Remarkable little user irritation.
Why can't Microsoft copy this behavior ? It has been for sale since 1988.
OS X isnt perfect, but sometimes it is better.
People bitch when it's so easy to get this stuff on a windows machine, Microsoft finally does something about it and people decide to bitch about that.
No, people aren't bitching about them doing something, they're bitching about them doing something WRONG. Linux and Mac's have a similar approach to this problem, but their solution (sudo) is not annoying, so it actually works. All Microsoft had to do was copy that solution to improve security, instead they came up with their own and made it obtrusive in the process.
I have yet to experience these supposed headaches with Vista yet, the only time that shield pops up is when I run a program that is potentially harmful to my computer
Although I also have not seen these prompts when copying text, I have seen them in plenty of places aside from installing programs. Places that make absolutely no sense, such as storing wireless settings. There is no reason that action should require admin privileges and thus a prompt.
How many story's were posted about programs looking like they came from an official place only to release a trojan? sure you get a program from download.com and figure it's safe but after installing a program it suddenly fucks up your PC, with Vista it will actually ask if you trust it let you know where it came from the works.
And how would that help? You download a program from somewhere, and double click to install it. Whether it is a trojan or not, Windows is going to ask you for permission. Since you downloaded it, you obviously think it is not a trojan, so you would press Ok on the permissions dialog. Turns out it is a trojan, and your system is compromised. A permission dialog does nothing to protect you here.
What you aren't understanding is: it isn't the concept of asking for permission when you need to do something that requires administrator rights, that Microsoft got right, it's the way they implemented this feature that is so bad. Microsoft often gets the general ideas right, but the details are so wrong.
Higher up in the thread someone mentions what happens when you copy a file to a folder in Program Files. Because Program Files folders are protected you need elevated permissions to do that. The right thing to do is say that it requires elevated permissions, ask if you want to do it, then do it. But in some cases it asks you 3 times for one file (do you want to copy, do you want to elevate, do you want to overwrite, do you want to be admin, do you need help with writing your letter). Why can't they give you one box that says, "The file already exists and this copy requires administrator rights, do you want to allow this?", then when you say OK, you are done. Why, why, why can't they do this, are they short of money?
And Mac and Linux do exactly the same thing, they ask your permission to do admin tasks, except they got the details right so they don't irritate the user to death. A guarantee people are just going to shut off UAC because it's annoying, defeating the whole purpose.
My few hours with Vista taught me something important about operating system design. That is, a good operating system should make you feel like you're in control of your computer. Like you're the one calling the shots and that the system will do exactly what you want it to do without fuss. Further, the experience of using a good OS should make you TRUST your computer and feel as if your computer TRUSTS you. You should not have to beg an OS to install an app or run an executable. Even if you do something that is possibly dangerous to security, the most it should do is ask "are you SURE?"
I don't want to wonder if my computer is tattling on me if I'm downloading an mp3 without DRM or watching a copy of a video that a colleague gave me. I don't want to think my computer is a rat or a punk. I don't want to think my computer will rebel if I run a perfectly legal program like Alcohol or rip.net or want to install the k-lite mega codec pack.
DirectX10? It's going to take more than DirectX10 for me to accept my computer as a spy in my home.
You are welcome on my lawn.
And the worst part is, if you tell them the truth -- "it does that because Microsoft sucks at making software" -- they don't believe you and think you've got some kind of unfounded grudge against Microsoft!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz