Tricking Vista's UAC To Hide Malware

Vista's User Account Control, love it or hate it, represents a barrier against unwanted software getting run on users' computers. A Symantec researcher has found a simple way to spoof UAC and says that it shouldn't be completely trusted. The trick is to disguise the UAC warning dialog in the color associated with alerts generated by Windows itself.

Comments

Importance?

[MrNonchalant]

"Would the user treat this UAC with the same amount of caution?" His answer: No. Users will, as Microsoft intended when it selected those colors, note the teal border of the spoofed UAC and likely click through without a second thought, he said.

I've been using Vista for a month. There were color differences?

Re:Importance?

[leuk_he]

Never noticed these colors as well.

I did try to cut the number of warnings given, but uac still is not yet at a level it is user friendly.

Let me point out:
-It sometimes tells the publisher is unknown, and sometimes it show the publisher, but say it is unverified. It is just a conspiracy with verisign to sell code signing certificates.
-Java vm had fine grained access controls a long time ago, and the NSA build these into windows NT 4.0 also. But all UAC allows is to give full access(=admin that can install drivers) or deny (no option most of the times) it. Yes, you can apply all kind of rights to the user, but not to a program... This is a lost opportunity.
-Once UAC is popping up you have no way to take back control. So guess what a user does when he is confronted with {while (true)askPersmissiontoinstalltrojan;}
-...???
-profit. Yes for Steve Ballmer that is... ;)

Re:Importance?

[Asztal_]

I guess if you didn't notice, it's possibly because you knew what you were doing at the time and just clicked allow/continue without second thought. Or maybe you just didn't install/run unsigned software, which would generally be a good idea anyway.

This is essentially allowing a trusted program (RunLegacyCPLElevated.exe) to load and execute untrusted (unsigned, etc) code in its own, trusted, context... I don't see how that can possibly be secure, or how they can say it's not a problem. The obvious choice to me is either to display a notification when a "trusted" process running with full privileges dynamically loads an untrusted DLL (then again, that might get annoying, in which case they could have implemented some sort of flag in the executable's manifest meaning "this program may link with untrusted code, if it does at some point do that, then afterwards treat it as unsigned"). N.B.: I could be talking out of my arse here.

For reference, sometimes it just asks you if you want to allow an unnamed program - that's the orange dialog with the choice "allow/deny". It's not digitally signed, or the signature isn't trusted, so there is no reason to trust who it says it's from (I'm not saying digital signatures are foolproof, but they help), so it doesn't even say what program wants to do X or who it is from. Other times, it tells you who signed the software and that you should run it if you trust the signer - that's the grey/teal one with the choice "continue/cancel".

Re:Importance?

[gunnk]

What I want to know is if the system can't tell that *I* double-clicked on an icon to start a program, how does the system know that *I* clicked "Allow"?

If I had to enter my password to continue I would understand the difference, but just a click to continue? Does this work at all?

Re:Importance?

[MrNonchalant]

The environment you click that button in is a separate and theoretically secure desktop. That's why the screen dims: to indicate that. It's the same armor that protects your Windows password from keyloggers. Whether or not it's secure remains a largely open question. There are no exploits I've heard of to breach it, and Microsoft would (eventually) patch said exploits if they became apparent.

Re:Importance?

[Asztal_]

The difference is that for the UAC dialog the system switches to a system-owned desktop (note that I am using the word "desktop" in the sense of the Win32 programming model), which programs on your application desktop can't access. They then also can't control or read from the mouse or keyboard. Basically, the only way they could click "allow" for you is if they baddies had installed an evil driver or maybe replaced core system files which generated the prompt, in which case you've already lost.

It's similar to the way that when you press ctrl-alt-delete on Windows NT, it switches out to a different desktop (the idea being that since only the system itself can trap Ctrl-Alt-Del, you know it is definitely the system which created the desktop on which you are entering your credentials).

Re:Importance?

[Ed Avis]

When you press Ctrl-Alt-Del in Windows XP it doesn't always block other applications from accessing the screen that appears. I'm sure I've seen third-party software display random crap dialogue boxes (often crash dialogues) on the login screen, and another example is that StickyKeys thing you can sometimes activate by pressing Shift five times. The principle of having a secure attention sequence is good though.

Re:Importance?

[leuk_he]

I am using/installing open source software. Since vista was/is new to me i have to carefully read what it press. But open source software is seldom digitally signed. The only value of a digital signed is that you know who wrote the software, it will never say anything about quality, and so far it never was about any guarantee made by the supplier of the software.

If ths software is supposed to come from a major publisher, (like Microsoft, or adobe, or symantic) it might be worth something. However if you run a game that is signed by some lessknwon studio that is a publisher for some other softwarehouse, you cannot determine if the signee is the one that is actually supposed to be the one distributing the software, so the signature is almost worthless.

It could have least ALWAYS show the not trusted publisher.

But dumb users will either have UAC disabled or learned to press the "Yes/Ok".

One thing good from this is that software will be written to be run as Normal user instead of administrator. That is the good thing about UAC.

Re:Importance?

[JackPT]

With standard Vista accounts users have to enter an admin password as well as click the UAC confirmation. This is similar to Ubuntu when standard users want to use admin privileges or even OS-X. I'm not suggesting Microsoft would dare rip-off OS-X though... heh.

Re:Importance?

[jacksonj04]

Likewise. I've been using it since business release and never spotted different colours (Yes, I'm using Aero). I've noticed subtly different dialog messages for UAC depending on if it's signed or not, but never colours.

Re:Importance?

[et764]

With standard Vista accounts users have to enter an admin password as well as click the UAC confirmation. This is similar to Ubuntu when standard users want to use admin privileges or even OS-X. I'm not suggesting Microsoft would dare rip-off OS-X though... heh.

What's to stop a malicious app from spoofing the password dialog on Ubuntu/OSX/Windows? You could conceivably have a nasty application that pops up a fake password dialog, gets the user's root password, and sends it off to some nasty people somewhere else. This system has the advantage of letting the user run with least privilege, but the trade off is that it desensitizes to user to typing his admin password, making it easier for a social engineering attack to steal the password.

Windows addresses this with the login dialog by requiring the user to push CTRL+ALT+DEL before entering a password. As long as only Windows can intercept CTRL+ALT+DEL, secures you from spoofing. I haven't seen a similar mechanism anywhere else, whether in Ubuntu, OSX, or the Windows UAC prompts.

Re: Importance?

[Dolda2000]

The really stupid part about UAC, as I see it, is this:

The anti-password-keylogging protection which you mention is at least initiated by the user, by pressing Ctrl-Alt-Delete, which the Windows kernel treats specially and only dispatches to the security subsystem -- therefore, it is impossible to write a trojan which would simulate the Windows C-A-D logon procedure, since the trojan couldn't know if the user presses C-A-D.

On the other hand, a UAC prompt, at least as I've understood it, is initiated by programmatic action. The way I've understood it is basically that if a process tries to do something which would normally return some kind of EACCES/EPERM error (whatever it's called in Windows), the system catches it, displays a UAC prompt and, if the prompt isn't denied, raises the privilege level of the calling process as required not to return EACCES/EPERM. However, since the action is initiated programmatically, I don't understand why a process can't simply fake the "secure desktop" by fabricating a look-alike. It would be the perfect way to steal the password from a non-privileged user. Also, as another commenter mentioned, UAC seems to allow for a rather nasty DoS attack by means of simply doing a UAC-prompting action in an infinite loop, since it is system-modal (thanks to the secure desktop). Of course, there are also the other numerous problems with UAC, like the user just getting used to clicking "allow" whatever is prompted for.

Unix had it right from the beginning, by having "su" or "sudo" being a user-initiated action. I'm quite a bit against the newfangled behavior of modern distros to automatically ask for the su/sudo password whenever an administrative program is launched from the program menu -- it moves it a bit closer to how UAC does it. Instead, I would think it better to have a tray icon or similar, which the user can click on, be prompted for the password, and thenceforth having programmatic sudo automatically acknowledged until the tray icon is instructed to deny it again or until a timeout passes -- much like sudo currently works.

Re:Importance?

[Pikoro]

I always thought that it would be a good idea to reverse the OK/Yes and Cancel/No buttons on security oriented dialogs.

This way, the user will default to Cancel/No when these kind of things show up, forcing the user (for a while at least) to pay attention.

The down side of this is alot of people won't realize they just clicked Cancel instead of OK and will sit and stare at their desktop waiting for something to happen...

Re:Importance?

[redcane]

Of course you could use the dos linuxloader to load an X session, where programs can respond to CTRL+ALT+DEL...... Then draw a fake windows log on screen, and snatch username/password, save to C drive along with trojan emailing it back to you, fake blue screen, reboot. The whole CTRL+ALT+DEL protection only works while every operating system traps CTRL+ALT+DEL, and no-one writes a new one.

Re:Importance?

[et764]

Assuming that your operating system has been securely installed, either by yourself or a trusted vendor, and that your PC is protected from unauthorized physical access, this is not a major problem. If these things aren't true, you probably have bigger problems than someone getting your admin password.

Re: Importance?

[MrNonchalant]

You may well be right there, but the implication that a spoofed UAC prompt could result in a stolen password is (I think) false. I've never been prompted for my password in UAC, it's all just clicks. Perhaps if the user understands what the screen dimming thing is supposed to mean, but by that point you'd hope they'd also notice the different-from-usual dialog. If they don't then they're likely the kind of user which you probably didn't have to go to all that trouble to fool anyway. Which, sadly, is a large percentage of users.

Re:Importance?

[pAnkRat]

But in windows, the CTRL-ALT-DEL from keyboard only, is not correctly implemented either.
For instance:
If you install vnc as a service, you can invoke CTRL-ALT-DEL from the viewer menu.

So just probing for the CTRL-ALT-DEL combination means not necesarily that it was invoked by the (hardware) keyboard/user

Re:Importance?

[june_c21]

I don't think this is important. normally end user doesn't care about it and will continue using it without knowing it too.

paraphrase

[physicsboy500]

I love Microsoft's response:

Meh... the same users who show enough common sense to click on the "you've won a free ipod enter your credit card information here" will obviously be able to know the difference between a good system message and a bad system message

Hooray for apathy!

Re:paraphrase

[risk one]

Hooray for apathy!

Meh... it's alright, I guess. I could take it or leave it.

Re:paraphrase

[SydBarrett]

So, Vista is gonna prevent me from winning Ipods?

Screw that, if i'm the 999,999th vistor I deserve a prize and I dont care what no washington computer fatcat wants to do with my internet windows.

Re:paraphrase

[apathy maybe]

What's the difference between ignorance and apathy?
I don't know and I don't care.

Re:paraphrase

[CDarklock]

Here's my paraphrasing. (Admittedly biased.)

"It would start with a user falling for any one of the current hacker tricks."

Now, call me dense, but... why exactly doesn't the hacker use this trick to DO WHAT HE WANTED?

I mean, think about it. Assume you can convince a user to run any program once, and you want to set up a botnet.

Should you:

A. Send the user a program that sets up an elaborate trust circumvention mechanism so he can be convinced to run the program which installs the botnet?

or:

B. Just send him the program that installs the botnet?

Am I off base here?

Re:paraphrase

[RobertLTux]

its the difference between picking the lock on a door and using a largebore shotgun to blow the door off its hinges

Re:paraphrase

[CDarklock]

Not really. It's more like breaking into a house to install a complicated machine that unlocks the door from the inside, so you can come back later and rob it. It may be a bad situation, but it's never really going to happen, is it? If you already broke into the house, you're just going to go ahead and rob it.

Everybody wants to believe that the people installing botnets are hackers, but they're not. They're criminals. The people running security companies are hackers. They think building these fantastic scenarios is fun, because it is, so they spend all day doing it. Meanwhile, the criminals on the street don't give a shit. Lockpicks? Shotguns? Fuck that, I got BOOTS. Boots can open a door REAL good.

Its tricking the user as much as Vista

[Chrisq]

Basically its a way to get a green pop-up, which usually means safe applications. It relies on the user blindly saying "yes" to these green pop-ups

Re:Its tricking the user as much as Vista

[POTSandPANS]

After using vista for about an hour on a customer's computer, I was pretty much trained to click yes on all those things too.

The problem is that while we may actually read those warnings, most users are going to see it as an extra step they need to do in order to get their free ipod/car/vacation/porn. It wouldn't surprise me if directions to help users "get rid of those annoying uac popups permanently" soon show up on a few malware-providing websites. Just look at the firewall rule set on some people's computers.

Re:Its tricking the user as much as Vista

[Mister Whirly]

You can turn off the Security warnings in the Security Center under the control panel, and clicking the Change the way Security Center alerts me.

You can turn off the Desktop Cleanup Wizard by going into the Display Properties and clicking the Customize Desktop button on the Desktop tab and unchecking the box that says "Run Desktop Cleanup Wizard every 60 days".

You can turn off printing notification by going into Printers and Faxes and from the File menu, select Server Properties. Click the Advanced tab, and then check or uncheck the checkbox next to Notify when remote documents are printed to either enable or disable the printing notification.

Maybe instead of blindly clicking close notifications, you should actually spend 5 seconds googling and figure out how to change the interface. XP really isn't too hard to use if you spend some time learning about the features.

Not an issue

[picob]

I couldn't say it better than a header in TFA:

Microsoft: Not an Issue

Re:Not an issue

[Zantetsuken]

I think he meant it as a play on what they said - that MS Corp isn't an issue... but thats just the way I read it...

We need to cut down on the complexity.

[Anonymous Coward]

With every release of Windows, Microsoft seems to devise some new, overly-complicated scheme to try to protect Windows users. The scheme they came up with may sound great, but then it falls flat on its face because of some minor flaw or workaround.

So maybe what they need to do is to get back to the fundamentals. We only need to look as far as OpenBSD to see how keeping things simple and intelligent results in a very secure operating system. Instead of writing new (and probably buggy) code to try and prevent things like malware, they just repeatedly go over the code they already have, to try to ensure that it is exploit-free. And it works. OpenBSD is a damn secure system.

Re:We need to cut down on the complexity.

[John Nowak]

Oh please. OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is. User level permissions are more than sufficient to start up some malware automatically every login, not to mention sufficient to wipe out all of your important data. (No, /usr/bin generally isn't that important.) I love OpenBSD, but please, be rational.

Re:We need to cut down on the complexity.

[peragrin]

Why don't you be rational. So that user's directory get's trashed. but trashing that directory also kills off the malware. If it doesn't a simple search for that user's remaining files will. All that remains is a simple backup restore and your good to go. total time to repair maybe an hour.

To clean a Windows box means reinstalling the entire damn thing.

It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked, unlike Windows up to XP which it can be fully automated. I will hold off on final Vista judgments until more information can be gathered.

To Quote Scotty in Star Trek III The more they over think the plumbing the easier it is to stop up the drain.

Simple *nix user level security has proven for over 20 years to be more effective than anything MSFT has produce in the same amount of time.

ACL's make life easier for large installs, but it is the small ones that cause the most problems. That is why large *nix installs use both.

Re:We need to cut down on the complexity.

[99BottlesOfBeerInMyF]

OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is.

This is not exactly true. On OpenBSD finding a local elevation vulnerability to allow you to root the machine from an untrusted account is nontrivial. To date, that is not the case with Windows, including Vista which already has unpatched, outstanding elevations. Further, on OpenBSD the user can install software as the local user for the most part, whereas users are prompted for admin access to run installers, by default, in Windows. Finally, you can install TrustedBSD and run said malicious evil binary without any real risk.

In general, however, I think you're correct. Microsoft should not be looking at the average OpenBSD install as the model for their security because Windows has a different set of problems than OpenBSD. Windows is constantly being subjected to attacks by malware and if OpenBSD was subjected to the same level of attack, it would adapt and develop more secure methods. MS should be looking at TrustedBSD or SELinux as the model for their security. Copying OpenBSD (which is sort of what UAC is an attempt at) is not sufficient to actually solve their problems.

In order to provide users with a secure desktop, MS has to innovate and be one of the first to adapt ultra-secure MAC type security in a novice user desktop. Sadly, MS is not exactly up to the challenge of innovating much of anything, especially when three vital components of such a system are fundamental security, user interface design, and competitive third party integration. MS constantly puts marketing and bundling ahead of security, makes terrible UI choices, and uses every new feature to lock out competition rather than invite it in some market. As such, I don't believe they are capable of providing a secure OS.

Re:We need to cut down on the complexity.

[caluml]

It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked

Eh? Says who?

Re:We need to cut down on the complexity.

[MajinBlayze]

To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing all documents/etc is marginally better than reinstalling the whole OS. There is no reason that an application should have this kind of permission, IMO, we need to look past user level permissions to application level permissions, as this is where real security exists.

Re:We need to cut down on the complexity.

[MajinBlayze]

Sorry, that looks a little trollish: I should point out that I am a happy user of Gentoo Linux. My personal opinion on linux is more that it is infinitely customizable than infinitely secure.

Re:We need to cut down on the complexity.

[dioscaido]

The security model in BSD and Windows are the fundamentally same. Resources on the system are protected by access lists defined for users/groups. Administrators/Root have full access to change anything in the system, absolutely no way around that. Windows screwed the pooch because in its migration from Win98 (single-user, no security) to the Win2k/XP platform (already mature user and ACL implementation) they had to keep app compat or lose the market (computers were not powerful enough to get virtualization in the picture yet). So, applications expect administrator privileges, and hell even parts of the OS are guilty of this (i.e. - double click on the taskbar's clock as limited user in XP).

With this as background, their task in Vista is huge. You can't keep users running as Administrator and be secure, period. The same thing would be true of linux if everyone ran as root. But the biggest selling point for Windows is app compat. So we have a middle ground to affect a transition between a Admin and a non-Admin world -- UAC. People are still administrator, but under most circumstances (before the UAC prompt) everything runs as limited user. App compat issues are partly fixed with virtualization that allows admin apps to run as limited, but most are solved by simply asking for admin access, but just for these applications. Slowly the whole application ecosystem moves to limited user supprt, and UAC prompts are fewer and far between. I would expect that in the next windows UAC will be much different, if non existent.

In either case, like MS says, UAC is not a security boundary per-se (although it can be used as such). Common sense should dictate that if you get a prompt out of the blue, green or non-green, you should cancel.

Re:We need to cut down on the complexity.

[99BottlesOfBeerInMyF]

To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing[sic] all documents/etc is marginally better than reinstalling the whole OS.

There is one important reason why compromising a user account versus compromising a machine makes a difference and that is, just compromising a user account does not necessarily give a worm author sufficient access to add a machine to a useful and profitable botnet. As such, even if a worm author can destroy everything in the user's home directory, they aren't going to because it doesn't make them any money. Being so poor you can't afford shoes won't help you outrun any muggers, but it is likely to decrease your chances of being mugged in the first place.

There is no reason that an application should have this kind of permission, IMO, we need to look past user level permissions to application level permissions, as this is where real security exists.

I 100% agree on this point. It is long past time Windows made use of NT's ACL capabilities. I'm hoping Apple gets their MAC and signing frameworks up and running correctly in the next few years so MS has something to copy.

Re:We need to cut down on the complexity.

[cortana]

And that directory is backed up... isn't it?

Re:We need to cut down on the complexity.

[I'm Don Giovanni]

You're assuming that "wipe out all of your important data" == deleting the files. But it can also mean altering the files, such that the user would never know about it (until he opened that file again, perhaps). In which case, the next time you did a backup, you're backing up altered (i.e. corrupt) files. So your system isn't fullproof at all.

Re:We need to cut down on the complexity.

[MajinBlayze]

There is one important reason why compromising a user account versus compromising a machine makes a difference and that is, just compromising a user account does not necessarily give a worm author sufficient access to add a machine to a useful and profitable botnet.

If you can execute arbitrary code* at the user's permission level, you have access to everything the user can do; set up a user cron job, for example, to get instructions from a botnet. or even just launch your great ad popup campaign every 30 seconds while the user is logged in.

* this is really the problem with all security models, and why I beleive that application level permissions is the future of computer security.

Re:We need to cut down on the complexity.

[PitaBred]

But it's impossible to run a privileged service (port under 1024) as a normal user in Linux. That'll stop a lot of random mail relays, as well as other "fake" servers. You can't just use a random user-privileged unix account to serve up your phishing site, or to do a lot of things that a typical Windows pwning will allow.

Re:We need to cut down on the complexity.

[99BottlesOfBeerInMyF]

If you can execute arbitrary code* at the user's permission level, you have access to everything the user can do; set up a user cron job, for example, to get instructions from a botnet. or even just launch your great ad popup campaign every 30 seconds while the user is logged in.

Ahh, but does the user's non admin account have permission to open up the port to connect to the IRC control channel, or whatever is being used in the current botnet control tools? Does the user have permission to root the box, so that it can disable the antivirus, so it is not detected? Does it have permission to send ICMP pings to DoS some server?

In many cases the answer to these questions is "no." Most worms these days are trying to root machines and setup a botnet. Some uses of the botnet can be accomplished without admin access, but a lot of them cannot. Botnets mostly are used to send spam and launch DDoS attacks. Can a non-administrative user change the mail server or start a new one? A bot without administrative access can certainly launch an HTTP based attack, but other types are somewhat limited. I don't even think you could launch a proper DDoS on the root DNS servers without admin access.

I beleive[sic] that application level permissions is the future of computer security.

I agree with you there and am a big proponent of MACLs. I'm not trying to imply that application level security is not needed, only that there are some real differences between the dangers posed by compromising a user account on a UNIX machine, versus on a Windows machine, or root on either.

Re:We need to cut down on the complexity.

[Tony-A]

The security model in BSD and Windows are the fundamentally same.

Ummmm. No.
BSD is open. People are expected to be able to easily see who/what is running or doing whatever.
Windows is closed. People are expected to be protected from "noise" that might alarm (or inform) them. This dates from @ECHO OFF in DOS.

There is a reason to put streetlights in high-crime areas.
With streetlights you can see who is mugging you.
Turning off the lights gives a false sense of security.

What is running in Windows?
There is a processlist that seems to be missing stuff.
This is a list of names that the processes claim
Some huge pile of DLLs from wherever.
End Process that just laughs at you.
Is the default still to hide viruses (aka system files)?
Is the default still to hide file extensions? hey-stupid.txt.exe?

Re:We need to cut down on the complexity.

[Tony-A]

Oh please. OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is.

Oh yes. The Unix Honor Virus.
Never seems to go anywhere though.

Re:We need to cut down on the complexity.

[Bungie]

What is running in Windows? There is a processlist that seems to be missing stuff. This is a list of names that the processes claim

Obviously you haven't run any NT based version of Windows. The task manager shows all processes as their executable name, there's no way you can hide anything. The Vista task manager can even go so far as to tell you the actual path to the process and the command line parameters which were used to execute it. Only in Windows 9x could you "hide" a process in task manager, however the information on all processes could easily be seen in WinTop, an application included in the Windows 95 Kernel tools.

Some huge pile of DLLs from wherever.

Using the System Information tool you can easily view all of the DLLs loaded in the system. In Windows Vista the dynamic linker can even track which applications are using any specific DLL

End Process that just laughs at you.

This was mostly again a problem in Windows 9x, under any NT based OS the process will immediately be terminated when you click the button, unless it is waiting for I/O from a device. Windows Vista addresses this issue as well by allowing cancellation of I/O requests.

Is the default still to hide viruses (aka system files)?

Oh come on, were you seriously one of those people who thought WINDOWS.EXE was an actual system file?

Re:We need to cut down on the complexity.

[peragrin]

your right the user folders are important. but what percentage of computers made in the last oh 8 years has at least a CD-R drive?

backing up user data is far easier than backing up a whole system.

When i used windows my personal data was all that was backed up. everything else always got reinstalled from scratch anyways. it was the only way to be sure that no viruses made their way through the reinstall process. I backup monthly, for me that is all i need. my 10 gig mp3 collection, my 2 gig photo collection all backed up to at least two sources. Once a year after doing my taxes I back them all up again just to make sure I don't miss anything.

on a multi-user machine, something that home users should have been using in XP for at least 5 years now, is a good thing. that way when the kid downloads something bad. only the kid loses data. not the entire family.

Of course you knew all that right?

Different colors??

[drawfour]

While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell), so why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

To be honest, Vista's UAC saved my butt recently. I have no idea what application was vulnerable -- but it somehow tried to run exec.exe, which was downloaded into one of my temp folders. The file was deleted after it failed to run (because I said "no"), and then would appear back in a few seconds and try to run again. I'm happy that whatever application was vulnerable wasn't able to do anything to my system.

<tangent> Anyway, while some people may say it's annoying, I'm not sure exactly how many actions a typical user would take that would require UAC prompts. After the first few days of configuring, installing apps, etc..., I have little need to do anything that requires UAC prompts. Defrag is set up to run every night, anti virus is set up to download updates, my resolution settings don't change, etc... </tangent>

Re:Different colors??

[Anonymous Coward]

While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell), so why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

One of the problems is that you can set the "green" ones to be always accepted in corporate networks to allow users to run certain programs that are part of Vista. So yes, this has some potential to do damage.

Re:Different colors??

[Denial93]

> why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

Colorcoding is an attempt to make the user differentiate, not a piece of extra information.

Consider the situation of the unknowing user, who is confronted with a warning but has insufficient information on its meaning. There will be many of those. In some cases, denying access can give no feedback, in others it can immediately make important things not happen, i.e. negative feedback. Allowing it will almost always result in no feedback because the nasty code, if present, works in the background. In the absence of other information, users will usually attempt to avoid negative feedback, i.e. will establish a semi-conscious always-allow habit. M$ is not trying to educate the user (because users don't like to be educated, least of all in the middle of other work), they are trying to break the uniformity of some users' response to warnings.

Re:Different colors??

[dysfunct]

I don't think any user would know that.

I wouldn't be too sure about that. The article mentions that "the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system". Since this dialog will likely pop up frequently with a low chance that the user triggered it unintentionally (i.e. the user knows what he/she is doing) it might actually lower the barrier of clicking "Allow".

Don't forget that even though a user might not consciously notice the color after a lot of usage and especially repetition the brain might subconsciously notice the difference between a red (not as often appearing -> think twice) and green (frequently appearing after normally trusted "system" action -> just click on the damn thing) border and act accordingly.

Re:Different colors??

[codepunk]

Exactly what I was thinking, makes you feel all warm inside that vista is letting you know your
box is already owned.

Re:Different colors??

[kingturkey]

Having to click through 3 different prompts in order to delete a file was enough for me to disable UAC. It lasted about 2 days on my computer.

Re:Different colors??

[mrcdeckard]

The file was deleted after it failed to run (because I said "no"), and then would appear back in a few seconds and try to run again. I'm happy that whatever application was vulnerable wasn't able to do anything to my system. this is what drives me crazy about windows. ok, so you kept the file from running, but you said it reappeared a few seconds later. weren't you interested in where it was coming from? to me, windows' file structure and that mess the registry are so convoluted that there isn't any hope of cleaning them out. when i find out malware has infected my system, i grab the system disk (always within arm's reach of the windows box) and reinstall.

i'm no system admin expert, but i feel that i can at least *navigate* the system in linux and os x....

mr c

Re:Different colors??

[drawfour]

Yes, I was very interested. I narrowed it down to one of two apps -- IE7 and AIM. Supposedly, AIM is vulnerable to some VML exploit, and IE7 supposedly _was_, but was supposed to have been fixed before release. What I really wish is that Vista would tell you what application launched the offending app.

Re:Different colors??

[seligman]

While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell)

The text in the dialog is different. The two being talked about in this article say "Windows needs your permission to continue" and "A program needs your permission to continue". You can see an example of these dialogs here. Scroll about a third of the way down to a flow chart showing the dialogs.

Though, I think this is all much ado about nothing. Computer users these days have been trained to find and click on the "Continue" button as quickly as possible, I have yet to see why the UAC dialog will be any different.

Re:Different colors??

[jp10558]

What's not so exciting is you can add this sort of protection (and also tell you what launched the app) to XP just fine, and 2k for that matter with products that are less expensive than Vista. ProcessGuard, Prevx and more provide this ability. Some are free!

Granted, they just tell you when an unknown app is trying to run, but hey - you can also set it to remember your answer! It uses hashes of the executable, so when it updates or something, you do get asked again.

Granted, this is taking it a little further than Vista does, but it seems like as useful, if not moreso, a scheme that doesn't require an expensive upgrade to a so far mostly untested system.

And I still think the free CoreForce will be where it's at.

C'mon, give MS a break here!

[pla]

That pops up a UAC dialog, but because RunLegacyCPLElevated.exe is set to run those Control Panel plug-ins with full administrative privileges, the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system.

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?

Sorry, this does not constitute a threat. Just one more indication that we need some form of licensure before letting people anywhere near a computer.



I'll gladly join in on the MS bashing - when appropriate. In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

Re:C'mon, give MS a break here!

[teridon]

Ah, elistism at its finest.

Computers seem to be heading in the direction of becoming more like appliances; something you just use to do what you want. Why should a normal computer user know exactly what's going on behind the scenes for every action they do?

I consider myself an advanced windows user, but I'm still not sure at all times what every application and service and background process is doing. If you tell me you DO know EVERYTHING that is happening -- well you are very special. Also, why should I care? Sometimes I just want to get my work done!

Re:C'mon, give MS a break here!

[stokessd]

"Computers seem to be heading in the direction of becoming more like appliances; "

True, and we are in a dangerous "middle-ground" between a complex tool that only knowledgeable people use, and a true appliance that anybody uses.

The problem is that the operating system is too brittle and vulnerable to be considered an appliance. Do you ever think about how you use your toaster? If I put this new organic untrusted bread in the toaster will my toaster be taken over and corrupt the blender and waffle maker and start a kitchen rebellion? If I put in this DVD of "Ishtar" in my DVD player will it require a weekend to reinstall it's OS and useful applications?

No, that doesn't happen because appliances are robust and there isn't much a user can do to hurt them when used in their intended ways.

Now the current computers (particularly windows) are becoming appliances but haven't gotten to the critical point where they really become appliances. that transition will happen when a big chunk of the OS is hidden from the user and the user works in a Sandbox. It will be a lot less useful because it will only do what it was designed to do, but it will be safe and reliable for it's intended purpose. Then it will be an appliance.

The problem is that computers are sold as the answer to lots of the average user's non-problems. Like any good for sale in a capitalistic society, it's jammed down the throats of everybody the seller can get their hands on. So lots of people who maybe shouldn't be using computers (in their current unrestrained form) are using them (they are the ones who you get your spam from).

This is a windows problem not only because of shoddy engineering, but also because of Microsoft's position in the market. Let's look at the three major OS's:

Linux (BSD et al): It's a computer hobbiest's paradice, lots of great code, well defined heirarchy. Plus in general hard to get your hands on if you are "Joe User" who just wants to get a computer to e-mail the kids at school. This means that the people who are using this os WANT to use it for some reason (insert long list here), and they are going out of their way to use it. This means that this segment is typically very computer savvy and not likely to be pwned as a group.

Macintosh: This is also a "Harder to get" computer for two reasons. First, they are very expensive compared to the best-buy special. Second they are only sold in a few places. These two reasons make the Mac a sought-out computer rather than what the sales droid told you to buy. The average user is probably less computer savvy than the average Linux user, but in the case of the Mac, apple also "has your back" to some degree with frequent patches and a well designed core OS that minimizes your risk to begin with.

Windows: This is the default OS you get if you close your eyes and pick a computer. This means that if you have no clue about computers, chances are you get a windows box. Its fertile ground for stupid users to take advantage of (can I interest you in a free screensaver?). And in addition to that, MS has huge legacy issues that they can't change or they break business apps. MS has painted itself into this corner by selling to the lowest common denominator.

Change the borders to any color you like, there are still a huge amount of computer users that shouldn't be computer users under the current OS choices.

Re:C'mon, give MS a break here!

[IWantMoreSpamPlease]

>>In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

There is a problem with this, ever seen a dialog box pop up saying that such and such is attempting to run, will you allow?

This is especially the case with Norton Internet Firewall, and the such and such can often be something like mspooler.exe, which to a standard user, or total novice is utterly meaningless.

Rather than pop up and say some obscurely named app is trying run, what about a dialog that says this application trying to run is part of the OS and is recognized as such?

In other words, give a meaningful plain english question, that might just allow the user to understand what's actually transpiring, as opposed to geek speek.

Re:C'mon, give MS a break here!

[pla]

Ah, elistism at its finest.

I know, right? Daring to think that people would bother to learn how to properly feed and care for a $500+ investment. I can act like quite the insensitive bastard some days...



Also, why should I care? Sometimes I just want to get my work done!

And I just want my car to get me to work. But if I don't know the condition of literally hundreds of seemingly-irrelevant aspects of that vehicle, it either won't continue getting me there every morning for very long, or in the worst case, won't get me there at all. From whether or not it has fuel and wiper fluid and a full compliment of working lights, to where I put the key in and which way to turn it and how far and if it wants the brake/transmission/lights/door/seatbelt in a certain state to start, to when I need my next periodic maintenance, to the countless conditions I might need to notice and evaluate while actually on the road.



I consider myself an advanced windows user, but I'm still not sure at all times what every application and service and background process is doing.

I don't need to know exactly how my transmission works, but I do need to take action if I find a pink puddle under my car.

On my machine right now, I have 38 processes running, which includes 35 services lumped into a half-dozen "svchost"s. I can't claim to know exactly how each of those 67 tasks (38+35-6) does its job, but I do know whether or not it "should" run under normal conditions.



Computers seem to be heading in the direction of becoming more like appliances

They won't ever get there, in their present form.

You may see a lot more dedicated computer-like devices, such as DVRs, email/web "appliances", and personal organizers; But the realm of general-purpose computing will always remain all but closed to those unwilling to invest the time to learn the basics. And by the basics, I mean a hell of a lot more than MSIE, Word, and Outlook.

Even beyond knowing what should run, though, even a total novice user should have the basic grasp of "I didn't just try to do anything that should require administrative access, why does it want elevated permissions?". If your microwave oven wants the PIN to your ATM card, you shouldn't need the message to appear in a different color to clue you in to the oddness of the request.



If you tell me you DO know EVERYTHING that is happening -- well you are very special.

No. Not special. Just "curious". If I open Task Manager (I actually use Sysinternals' Process Explorer, but same idea) and see something I don't recognize, I look it up. Simple as that. It doesn't take a genius or even hours of research, just Google and and a spare 30 seconds.

So yeah, if you won't invest that much time (per process) in operating an expensive machine, then you shouldn't use a computer. Or a car. Or any power-tools. Or reproduce. ESPECIALLY reproduce.

And if it makes me an "elitist", or just a plain ol' bastard, for thinking that some things in life require learning how to do them right - So it goes. But I don't get infected with spyware, so, take that as you will.

Re:C'mon, give MS a break here!

[hxnwix]

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel I believe that the Homeland Security system is mainly employed to incite fear in the voting public. That is why it's disparaged and believed to be useless - those of us who dislike it see it as a propoganda reinforcement apparatus.

UAC can also be seen through a cynical lense: it alerts the user to even the most trivial harmless request so that when anything of any sort goes wrong, Microsoft can plausibly say that the user permitted it.

Nonetheless, UAC using the color green to incorrectly indicate that there is not a threat is a problem just as the Homeland Security alert falsely indicating no threat is a problem.

Do you understand why?

Re:C'mon, give MS a break here!

[sydb]

No, computers are not becoming like appliances. Appliances do one thing or a small set of things well. Computers - "general purpose" computers - do whatever can be done by a Turing machine. This is the problem. A toaster does not run bread, it toasts it (I nearly said a toaster does not execute bread but that's debatable). Computers execute programs and users can't know what their computers do unless they educate themselves about how they work and the programs they run.

In the 70s and 80s you could buy dedicated word processors. They were appliances. If all your computer did was word processing, I'm sure you wouldn't be too happy, because you want to install and run new exciting programs that do new things with your machine. That ability comes at the cost of understanding what you are doing or losing control of your machine.

Re:C'mon, give MS a break here!

[Cycloid Torus]

There - right there in the 4th paragraph - you defined it - the next OS - the one my spouse, my kid, my mother-in-law ALL need YESTERDAY. They will never have half the knowledge of PCs that I have - and I find what I know to be inadequate over and over. I can't get really upset with the sludge I have to scrape out of their boxes.

I think (hope, pray, etc) that Open Source will provide well constructed (custom?) Sandbox OS for all of my relatives who look to me to fix their little problems now - with a service which keeps this tidy and right.

Smell the opportunity - like bacon frying...

Re:C'mon, give MS a break here!

[StikyPad]

This means that this segment is typically very computer savvy and not likely to be pwned as a group.

I think your logic is a little off there.

First, you're assuming that wanting to use Linux == computer savvy == security savvy, which is quite a leap. Everyone has to start somewhere, and a knowledge of Windows is only partially relevant to Linux. Furthermore, there's no way of knowing what percent of users bother to learn any fundamentals of the OS or security beyond what they need to know in order to accomplish their goals.

Second, you're assuming that the lack of malware/exploits is due to said savvy rather than inherent characteristics of the OS and/or the lack of attempted attacks against said OS. I can claim my black box has a 100% success rate against penetration, but if nobody's trying to get in, it doesn't really matter. If your goal is to create a botnet, or install advertising/spyware, it doesn't make sense to pick a very small pool (i.e., Linux) unless 1) you're gauranteed to have a nearly perfect infection rate, or 2) those systems have a greater capacity to accomplish your goal. In the first case, even the most malicious of Windows worms probably doesn't achieve a >=50% infection rate, so nearly perfect success seems like an unreasonable expectation. If you can hit 5% of 90% of the market, or 5% of 5%, which do you attack? In the second case, you're probably looking at a specific system -- let's say a bank -- in which case you're only concerned with the vulnerabilities of that specific implementation anyway. If they're running Windows, then a Windows vulnerability might be one possible avenue of attack, but alternative avenues will exist regardless of what OS they're using.

Change the borders to any color you like, there are still a huge amount of computer users that shouldn't be computer users

By that logic, there are a huge amount of people who shouldn't be car or homeowners because they don't understand how their locks work. And yes, we all pay when cars get stolen and homes are burglarized, in the form of insurance premiums and/or increased police presence.

It's simply economically infeasible to create specific devices for word processing, spreadsheets, e-mail, web browsing, etc, and the only benefit would be that an exploit would be limited to a specific device, maybe, if no two devices shared the same vulnerability, and people never e-mailed their infected files, or posted them online, etc. Cross-platform infections are theoretically possible, and if necessary (by which I mean, if everyone was using different devices and an attacker had no other choice), they would probably become a reality. So we isolate systems when there is an economic incentive to do so, such as in-flight-entertainment and flight control systems, but when the benefits of interoperability and/or connectivity outweigh the risks, we integrate.

As far as licensing, there is reasonable grounds to require a drivers license because an unknowledgable user could cause grievous harm to person or property. It's so improbable that they could directly cause damage beyond their own system through ignorance that we can consider it impossible. An unknowledgable computer user could facilitate grevious harm by not securing their system (and having it used in an attack), but less so than having their car stolen which is later involved in a drive by. In any case, it's the offender who is to blame, not the person who happened to own a computer/car with poor protections. We could possibly legally mandate increased protections, but again, is the cost worth the benefit? Since it's impossible to write bug-free code, the answer is probably no. Likewise, licensing would not solve the problem of poor protections, which are arguably a greater threat than ignorant misuse/misconfiguration of a system.

If we place responsibility for protection with the user, then the onus lies with them rather than the attackers and/or manufacturers, which is generally the oppo

Re:C'mon, give MS a break here!

[IchBinEinPenguin]

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?

Not to say that I take Microsoft security seriously, but...
... the reason DHS colour codes are (rightly) ridiculed is that they are undefined and therefore meaningless. No one knows what prompts a given level, or what response is required.

The UAC colours are supposed to mean something (code asking for permissions is "blessed by MS" vs "blessed by someone" vs "of unknown origin"). It turns out that this distinction isn't strictly enforced.

I still agree with what I believe is your overall sentiment though, trusting MS on security issues is like believing that taking your shoes off makes air travel safer.

Better listen up, guys...

[Donniedarkness]

Better listen up; this is coming from Symantec, the guys that brought us Norton Internet Security. These guys KNOW how to really mess computers up.

Re:Better listen up, guys...

[dr_d_19]

That's actually no joke. I haven't been able to uninstall (always "fails") from any of the computers where I've found it preinstalled. It always ends up in some half installed state generating errors at every boot and messing up Outlook.

Re:Better listen up, guys...

[Tim Browse]

I got Norton Utilities for Windows once, as I needed to undelete some files.

After I was done, I noticed it had some Norton Desktop performance tuner stuff, which I installed out of curiosity (I wasn't expecting much, tbh).

It was a goddamn joke - it displayed a shedload of shiny dials and meters, and had all sorts of omnipresent UI crap for me to play with to 'improve' my settings and performance.

The only trouble was, the mere act of installing all this shit made my PC take twice as long to start up, and seemed to run like a dog afterwards. I uninstalled it immediately, and suddenly my PC was way faster again.

To this day, I can't work out if Symantec was just playing some sort of post-modern joke on me.

Re:Better listen up, guys...

[PitaBred]

I just "fixed" my aunt's computer by removing Norton's shitware. It used to take 30-60 seconds to open up any Word document because the thing decided to virus scan it EVERY time it was opened. And this is on an Athlon X2 laptop with a gig of RAM. Sans Norton, it's running like the brand-new computer it is. I just installed AVG and Firefox for her, and she's off and running.

or, get it to look like spam

[192939495969798999]

Just get it to vibrate around like those horrible "you're the 99999th visitor!" pop-ups, and anyone would click whatever to get rid of it. Furthermore, you could change it to one of those "are you stupid?" pop-ups, that the "no" button moves around. There are a zillion ways to get someone to click the button you want.

Re:or, get it to look like spam

[Gr8Apes]

which is one of the reasons that *nix systems are far superior to Windows. Programs don't run until their permissions indicate they can run.

Re:or, get it to look like spam

[advocate_one]

what popups??? oh sorry, I don't do windows... you poor people...

Re:or, get it to look like spam

[Kalriath]

Really. Are you referring to the X bit in the RWX? If so, Windows does have an equivelant in its ACL. Any application on Windows, like *nix, can have its execute right revoked and it can't run anymore (though the message as to why is a little cryptic if you TRY running it). And, like on *nix, --X is allowed by default. So really...

which is one of the reasons that *nix systems are virtually identical to Windows. Programs don't run until their permissions indicate they can run.

Pick something which DOES actually put *nix on a higher level than Windows thanks. I'm pretty sure you can find SOMETHING.

Re:or, get it to look like spam

[greed]

Uhhhh....

What kind of broken software are you using on UNIX that creates files with X turned on by default? Outside of the link-editor (ld), everything else creates files with X cleared (and everything except explicit chmod runs all bits through your umask).

The only time I see gratuitously-executable files on UNIX is when they have been put there from archive files created on Windows or via Windows file sharing of some sort (Samba, commercial SMB, PC-NFS, AFS, DFS...). Which is where Windows FILE_EXECUTE defaulting ON is turning up again. (Or Samba's mapping of the 3 "X" bits to hidden, system, and archive because "Windows doesn't use the X bit".)

Never underestimate the security impact of poorly-chosen defaults.

Re:or, get it to look like spam

[Gr8Apes]

I'll take the other tact from greed's posting. Windows, by default, will run anything with .exe, .com, .bat, or .cmd extensions. There is no equivalent in *nix.

Mirrordot Link

[etwills]

I got binary nonsense when I followed the link to the article.

The Mirrordot link works: http://mirrordot.org/stories/bdc4f568dcc5c7b125832 2aec4d77944/index.html

Re:Mirrordot Link

[wjsteele]

Redundant? :-) I was trying to make a joke about the article being nonsense!

Bill

UAC is not there for *user* protection

[Theaetetus]

"It's very important to remember that UAC prompts are not a security boundary -- they don't offer direct protection," said Whitehouse. "They do offer you a chance to verify an action before it happens. Once you allow an action to proceed, there may be no easy way back. So while Microsoft may use the word 'trust' in relation to UAC in some of their [other] documentation, in actual fact, even the data these UAC prompts provide you with can't be trusted."

It's pretty obvious from Microsoft's response that this is an example of Bruce Schneier's "security theater". UAC doesn't actually protect the user, but it enables Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault." (or, more likely "you were so annoyed by UAC that you turned it off, it's not our fault"
This isn't security, this is a legal CYA.

Re:UAC is not there for *user* protection

[gsslay]

UAC doesn't actually protect the user,

I would be interested in what you consider would protect the user. You have three options here.

1/ No-one decides what goes on your computer. It's an open free-for-all.

2/ Microsoft decides what goes on your computer. Corporate lock-down.

3/ You decide what goes on your computer. You're the boss.

We've already seen what happens with option 1. It's a security nightmare for everyone. I can imagine just how popular the second option there would be, people already have plenty to bitch about the controlling nature of Microsoft without adding to it.

So it's got to be option number 3. The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide.

Which is pretty much what is happening here. And still people complain.

Re:UAC is not there for *user* protection

[Cro Magnon]

So it's got to be option number 3. The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide.

I agree with the choice. It's the user-friendlyness that's in question.

Re:UAC is not there for *user* protection

[jb.hl.com]

UAC doesn't actually protect the user, but it enables Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault."

It wouldn't be their fault. Nor should it be their fault.

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be? If you shoot yourself, are Smith and Wesson liable?

If Microsoft was held liable for the actions of third party applications, it would open up the way for lawsuits against pretty much every other OS provider that gave their customers a chance to run nasty programs on their OS. Imagine the lunacy that would result from that. Imagine the ass-covering lockdown that would most likely result. Not very nice at all...

Re:UAC is not there for *user* protection

[Theaetetus]

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be?

Microsoft should be held responsible, not for you running annakournikova.exe, but for having DCOM, Remote Administration, Messenger, etc. running by default. They are responsible for those - they could have had them off and let users turn them on if they wanted them, but they were more interested in helping out corporate IT departments than home users. As a result, their systems are secure, only when behind a corporate firewall. That's poor design.
UAC is merely an attempt to slap a "well, it's not our fault" on the design.

Re:UAC is not there for *user* protection

[99BottlesOfBeerInMyF]

I would be interested in what you consider would protect the user. You have three options here. 1/ No-one decides what goes on your computer. It's an open free-for-all. 2/ Microsoft decides what goes on your computer. Corporate lock-down. 3/ You decide what goes on your computer. You're the boss.

The basic problem is the assumptions behind your classification. You assume that "something on your computer" equates to "your computer is compromised." I agree that the user needs to be the one determining what is installed an further, I agree that the OS should, "warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide." You're still missing a piece of the puzzle here. The OS needs to let the user what is going on, very specifically and the OS needs to let the user allow and deny behaviors very specifically. That is how UAC fails.

Which is pretty much what is happening here. And still people complain.

The Register described UAC as "too little too late." That about sums up my opinion. It is a baby step in the right direction, but no where near enough to actually solve the problem users have and because of the implementation of certain elements may lead to long term greater insecurity because of the way it trains users.

Here's a simple example of how UAC fails and why. A user downloads a trojan installer and double clicks on it. Installers, by default, run as admin and require the user to click "Allow" in a UAC prompt. This means a trojan installer and a freeware game installer appear, to the user, to be exactly the same. Worse, the user has been asked to click "Allow" many times for other procedures where there was very little risk. What would make any reasonable security person assume the user will not click "Allow?"

My assertion is that by default the user should be allowed to install anything they want, but that all software should run in an ACL sandbox, by default, and should be restricted from certain behaviors by default and that the user should be prompted not when installing software, but when the software actually tries to do something most legitimate software does not need to do, and then they should be given well crafted dialogue boxes with unique actions for buttons to avoid conditioning.

This is entirely doable, it just requires that MS take security seriously and actually looks at the problem and the behaviors of users and creates a technological solution designed to solve that problem. UAC is a "me too" solution that tries to bring security up to par with common Linux and OS X desktops, but it ignores that those desktops are not under constant attack by malware while Windows is. Windows needs to be better than the average Linux desktop in order to provide users with the same risk of infection. UAC is nowhere near the level of security needed and the poor UI design exacerbates exisiting security problems brought on by previous poor UI designs in Windows.

Re:UAC is not there for *user* protection

[Theaetetus]

Which is pretty much what is happening here.

Not until Microsoft ships systems with all ports closed and no services running, by default. If the user wants Remote Administration, they should be able to turn it on. It should be easy and clear how to do so, but be off at the start. Remember DCOM? That's how not to do it.
Look at OSX - all ports closed, no services running, but trivial if you want to turn them on. As a result, the Aunt Tillys never enable File Sharing accidentally, and the LeetUberUsers can happily turn on as many services as they want.

Re:UAC is not there for *user* protection

[jb.hl.com]

That's quite different, and a bit of a strawman. Of course they should be held responsible for security holes which they introduced in messenger, DCOM etc; it's a different matter entirely when it comes to third party programs which they have no involvement with or approval of doing malicious or dangerous things, especially when the user explicitly allowed those things to happen. They might as well slap a "well it's not our fault" on the design, if only to make it clear that it isn't their fault if a program you installed and ran fucks something up.

(Of course this is all moot, since the EULA disclaims all responsibility and absolves Microsoft of all guilt. Nice of them.)

Re:UAC is not there for *user* protection

[goarilla]

isn't the Microsoft EULA their legal CYA ?

Re:UAC is not there for *user* protection

[Theaetetus]

(Of course this is all moot, since the EULA disclaims all responsibility and absolves Microsoft of all guilt. Nice of them.)

Not that moot... Click-through EULAs have been held to be non-binding in a few court cases.

Re:UAC is not there for *user* protection

[mattpalmer1086]

You missed two other options that might be useful to have:

4/ Whatever goes on your computer still requires privileges to execute.
5/ Whatever executes on your computer should not require all the privileges you have (e.g. delegate a small set of them to each process instead). Does this tetris game really need low level access to the disk driver? And a network connection? etc. etc.

Re:UAC is not there for *user* protection

[jb.hl.com]

Erm:

"Few cases have considered the validity of clickwrap licenses. However, in the cases that have challenged their validity, the terms of the contract have ultimately been upheld [...] Essentially, under a clickwrap arrangement, potential licensees are presented with the proposed license terms and forced to expressly and unambiguously manifest either assent or rejection prior to being given access to the product."

Re:UAC is not there for *user* protection

[Stormx2]

Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault."

Thats like saying "Well you were the one who pressed the on button! We can't be held responsible for that!"

Re:UAC is not there for *user* protection

[IthnkImParanoid]

Wow, a false trichotomy! Logical fallacies have reached new heights on slashdot!

Re:UAC is not there for *user* protection

[99BottlesOfBeerInMyF]

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be? If you shoot yourself, are Smith and Wesson liable?

The purpose of a Smith and Wesson is to shoot a person. The purpose of a consumer desktop OS is to run that user's software. If during the normal course of operation I needed to be some sort of an expert in order to safely fire a Smith and Wesson without the bullet hitting my foot, then yes they would be liable. Since most people are not coders and most software is not open source the fact of the matter is almost all users have to run software they don't completely trust in order to perform normal operations with their home computer. I don't trust Adobe, but I do need to run their software to do my job. I don't completely trust the Apache developers, but I don't have time or expertise to review all the code.

A properly designed consumer desktop system would take into account that most users need to run untrusted software and design the OS to do so with some level of security. UAC is MS's halfhearted attempt to sort of restrict applications a little bit in some instances, but it is nowhere near sufficient for the average user to be able to use with a reasonably low risk of malware infection.

Re:UAC is not there for *user* protection

[JackPT]

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be? If you shoot yourself, are Smith and Wesson liable?

No, not unless Smith and Wesson were selling guns to people they knew were going to misuse them. Microsoft knows that many of their users are totally security clueless.

Re:UAC is not there for *user* protection

[jvkjvk]

The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide. And here is where they went wrong. They thought that as much was a bigger qualifier than useful...

That's probably while people are complaining. Or haven't you used Vista?

Re:UAC is not there for *user* protection

[jb.hl.com]

No, not unless Smith and Wesson were selling guns to people they knew were going to misuse them. Microsoft knows that many of their users are totally security clueless.

Smith and Wesson sell guns to (almost) everyone, but they can't make the guns discriminate based on who's holding it. They don't know if people are going to use their gun to go hunting, shoot up a school or blow their brains out.

It's the same deal with Windows; Microsoft doesn't know whether people are going to be security conscious or if they just don't care. They sell you the OS, you're allowed to do whatever you like, and so long as it's within the limits of the EULA they don't care. In this kind of environment, where people have more or less free rein over what they install and run, how could they be liable for every little instance of malware?

Re:UAC is not there for *user* protection

[JackPT]

The point being that buying a gun, unless it's illegal, is a little more difficult that buying an operating system. It doesn't make Microsoft responsible for every malware instance (the people creating the malware are), but it does mean that they have a responsibility to ensure the users are aware of the risks. I don't think the present UAC implementation is adequate, particularly with the initial account having admin rights. I'm not talking about blame, rather the process of marketing an operating system as protecting users, when what it actually does is desensitise them to security pop-ups. It will desensitise them because the majority of programs they install will be benign, therefore they will end up clicking yes as a reflex action. I don't think UAC is a bad thing, just the present implementation of a binary yes or no question combined with users that know little or nothing about security.

Re:UAC is not there for *user* protection

[ChrisA90278]

"3/ You decide what goes on your computer. You're the boss."

THis is the best option but the word "you" needs to be better defined. "you" can ware many hats and have different roles and different times. The best way to do it would be to understand the "you" can be both a user and a system admin. The OS needs to force the Admin to make any changes to the computer.

Also programs started by a person run ONLY with the privelage of that person. So if you the user is running nothing you do can run as you the admin.

The system should force you to change your log in account to make system changes and it should also force you to not run as the admin for normal operation.

Look at how BSD works. It is simple to understand and for 20 years it has done well. So well that everyone (except Microsoft) has copied it.

Re:UAC is not there for *user* protection

[10101001 10101001]

So it's got to be option number 3. The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide.

Which is pretty much what is happening here. And still people complain.

Ah.. So close and yet so far. There's many things wrong with your argument. First and foremost, your three options are clearly wrong. You're argument lies on the assumption that programs and program-like data are the units of control that users should have permissions over and that it is those possibly malicious programs that are the intrinsic factors that make users safe or unsafe. Yet one could easily argue that having a user run as Administrator while not running malicious software can still be dangerous because even non-malicious software has been known to have bugs in them.

And that's a core problem. UAC isn't at all a useful warning to users. As has been pointed out, cutting & pasting in IE7 falls into the same UAC that covers moving files around. The reason for this stems from the fact that Windows itself is very incapable of differentiating what a user commands to be done and what a program, ran under a user's credentials, commands to be done. Instead of fixing that problem, MS has instituted a wrapper around nearly everything and slapped a new interface, UAC, which *can* determine if a user issued the command or not. To that end, the user remains in control. But as UAC is left to the whim of programs to intiate such actions at will, UAC becomes as useless at guarding against malware as car alarms are at warning the car owner that their car is about to be stolen--malicious youths can trivially set the car alarm off to the point that even car alarm owners tend to ignore the car alarm.

Personally, I am inclined to mock and belittle the car alarm. It sounds like UAC is following down that same path. Just because the intentions for UAC are nobile doesn't mean it's improper to belittle the implementation.

Re:UAC is not there for *user* protection

[gsslay]

My assertion is that by default the user should be allowed to install anything they want, but that all software should run in an ACL sandbox, by default, and should be restricted from certain behaviors by default and that the user should be prompted not when installing software, but when the software actually tries to do something most legitimate software does not need to do, and then they should be given well crafted dialogue boxes with unique actions for buttons to avoid conditioning.

This is a good idea, and not dissimilar to what I already do by running ZoneAlarm. Every application needs to request permission to connect to the internet, even after it has been given permission to install.

But the difference is that I know what I'm doing, and if I get a request from some obscure DLL I don't recognise, I go find out about it. I do not expect that of the average user. If this was implemented on most users machines they would simply get in the habit of clicking "Allow" in exactly the same way they do for installs. Except it would be three times as annoying, especially if you craft the dialog boxes to force them to read it every time.

And who decides what "most legitimate software does not need to do"? Who decides what's "legitimate software"? Sounds like you're asking Microsoft to make those calls for you.

There just isn't an easy answer here. Every method of security ultimately relies on someone making a decision at some point, and most users have barely enough knowledge to make that decision reliably. And makers of malware will do everything to exploit that weakness and mislead the user.

Re:UAC is not there for *user* protection

[gsslay]

Does this tetris game really need low level access to the disk driver? And a network connection? etc. etc.

"I'm a clueless user. I don't know. What's low-level access? What's a disk driver? Network, well , I guess... Quit asking me all these questions! (Clicks Allow, Allow, Allow)"

Which is pretty much where we came in....

Re:UAC is not there for *user* protection

[gsslay]

Wow, a riposte without any supporting argument! Pointless posting on slashdot remains at usual heights!

Re:UAC is not there for *user* protection

[mattpalmer1086]

If we insist that a user must make all these choices, then you're absolutely right. There are some other ideas about. One is that applications only have an absolutely minimal set of privileges instead of having access to everything that the user can do. Profiles for common applications can be created and validated by security experts. Users don't have to do much at all, and applications can't do much by default.

No UAC, clueless users remain safe, and even if some malware ends up on their machine, it basically can't do anything. Check out http://www.hpl.hp.com/techreports/2004/HPL-2004-22 1.html for an example of a system like this that runs on XP - it's a bit of a hack, as XPs security model doesn't really permit this sort of thing, but it gives the general idea.

Anti-Virus makers, make Virus.... same old scare

[Jackie_Chan_Fan]

These guys are pointing this out, because they want to sell symantec products. Thats the only reason why this article came out. It's the only reason why Symantec released this statement. They want to put the message out there that "You're not secure without Norton"

This is a corporate propaganda directive, possibly directly from the CEO him/herself. "Find something, and lets use it to make us money"

The old anti virus company making viruses, just to fuel sales... has come true. They dont have to release the viruses though, but simply they figured something out, and to tell the world that something.

Profit at all costs.

Re:I didn't think it was that difficult

[mgiuca]

Uh there have been lots of systems available to the general public for the twenty years Windows has been around. People didn't get over it.

Re:I didn't think it was that difficult

[SCPRedMage]

UAC prompts are NOT that common, and UAC prompts when copy and pasting is a myth. Please, let it die.

Re:Anti-Virus makers, make Virus.... same old scar

[MagicBox]

Sad scene. Symantect sinks to an all time low, after years of destroying countless Windows PCs and frustrating millions, all while being ineffective in detecting and removing viruses, but very effective in detecting and removing Windows kernel after flagging it as a deadly virus in your PC. The asking the user to REBOOT

No tricking involved

[LinuxGeek]

The main problem I have seen with Vista since the first RCs is the monotonous regularity that these messages pop up with during regular system use. The old adage that practice makes perfect is incorrect; Practice makes permanent is the real outcome and microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

I have found myself clicking continue at the same time my thought registers to *not* click because of something not looking quite right. Since I am no longer developing software for a living, the only OS on my system is Ubuntu! Thank God for Debian, Ubuntu, Red Hat, et al. for their tremendous efforts to give everyone a reasonable alternative; whether we choose to use it is certainly a choice, but we do have the choice.

Re:No tricking involved

[99BottlesOfBeerInMyF]

...microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

The "OK/Cancel mistake" has been in usability textbooks as an example of what no to do for more than a decade now. It is quite clear to anyone who has had any formal training in human-computer interaction that either MS hires the worst UI people on the planet, or the marketing department overrides all of the UI people's proposed changes. It is also clear that either MS is only vaguely aware that UI deign is an important part of security, or they are a lot more interested in providing the perception of security than the reality. My opinions is that Vista security is a lot like searches at the airport. For the most part it is completely ineffective at actually increasing overall security when it is important, but it is very, very visible and "in your face" so people assume "something is being done" and are mollified.

Re:No tricking involved

[MORB]

I think the only actual purpose of those UAC dialogs is just to shift the blame to the user (even though most probably end up always clicking ok without looking out of habit) if something goes wrong.

Re:No tricking involved

[99BottlesOfBeerInMyF]

Wait, I thought Vista stole it's UI from OS X, which supposedly has the best UI on the planet. Hmmm...

You're probably trolling, but on the off chance you're not, I'll respond. While a lot of both the feature set and the graphic effects in Vista seem influenced by OS X, the UI itself is still pretty much based upon Windows 95. Just because you are copying elements from a UI, by the way, does not mean the end result will be usable if you don't copy everything exactly and don't understand why certain elements were used in certain ways. For this particular case, you'll note OS X itself does not run afoul of the OK/Cancel mistake, because they name all buttons for real actions (OK is not a verb) and provide unique dialogue boxes and buttons for each occurrence and as rarely as possible.

Re:No tricking involved

[Mister Whirly]

Yes, I was trolling, but only half-heartedly, and not maliciously...

And IIRC, the Vista buttons are labeled "Allow" and "Cancel", which I believe are both verbs. I agree that Windows should have more unique dialog boxes, as to not lull the user into clicking when the see a box that they recognize. And for the record, I think Microsoft and Apple both stole the bases of their respective UIs from Xerox at the Palo Alto Research Center way back in the day...

Re:No tricking involved

[99BottlesOfBeerInMyF]

And IIRC, the Vista buttons are labeled "Allow" and "Cancel" which I believe are both verbs.

They are verbs, but they are not unique verbs associated with the action being taken, so much as generic terms. By presenting them repetitively, users are subjected to operant conditioning. People aren't machines, or at least not the same kind of machines as computers. After the 20th or 30th time clicking the same button, it starts to become a conditioned response and after a few years, users often don't even remember having clicked it.

And for the record, I think Microsoft and Apple both stole the bases of their respective UIs from Xerox at the Palo Alto Research Center way back in the day...

Well, you could say "Apple" stole the UI, but that is a pretty biased viewpoint from what I've read. As I understand it, Xerox developed a UI, but then mothballed it and developers from Xerox went to Apple and arranged a partnership with their old company to let them develop something similar for Apple. As for who MS stole their UI from, well they lost the lawsuit that says they copied it from Apple and paid fees to Apple in the beginning, so I unless there is a lot of information I don't know, they seem to have copied the Mac, not Xerox.

Re:No tricking involved

[cp.tar]

So, first they make you accept the EULA which says something like "yeah, you did pay us for this software, but if something goes wrong, it sucks to be you", then they give you the kind of security where everything that goes wrong is your fault because hey, you allowed it...

Does anyone need any more proof that Microsoft is Lawful Evil?

Re:I didn't think it was that difficult

[Cro Magnon]

Personally, I haven't had much trouble with UAC, and I do a lot of copy/pasting. It did come up when Firfox wanted to upgrade, but that's no surprise.

Re:I didn't think it was that difficult

[ferrgle]

Just to add the UAC prompt does NOT come up all the time and does NOT appear when copying or pasting.
It IS damn annoying though!
I personally feel that most people won't turn it off because they won't realise that they can.
But in saying that most people won't read what it says anyway.
(The above is based on experience.)

Re:Anti-Virus makers, make Virus.... same old scar

[Knux]

Actually, I feel quite secure with my XP SP2 behind a well configured router, without any anti-virus. I don't think I've got any viruses on it, but if I do, it doesn't feel as slow as a computer running Norton.

But, What Now?

[nwoolls]

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?

Re:But, What Now?

[99BottlesOfBeerInMyF]

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?

Well, one obvious answer is to provide fake UAC authorization prompt for dozens upon dozens of applications and hide the real UAC prompt in the middle of them. After six or seven the average user will just start hitting "Allow" for everything under the assumption that they need to to get their OS to work again, or they will turn of UAC entirely.

Re:But, What Now?

[Knux]

After six or seven the average user will just start hitting "Allow" for everything MS response: "We warned the user, it's his fault"

Re:But, What Now?

[Coward the Anonymous]

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?

If you read the article, you would have seen that they are not mimicing the UAC screen but actually causing Vista to prompt the user a real UAC dialog that grants Admin priveledges.

From the Article:

Finally, the malicious code would call the "RunLegacyCPLElevated.exe" -- the Vista executable that provides backward compatibility to older Windows Control Panel plug-ins -- which in turn runs the .dll. That pops up a UAC dialog, but because RunLegacyCPLElevated.exe is set to run those Control Panel plug-ins with full administrative privileges, the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system. As soon as the user clicks the "Confirm" button, the malicious code is granted administrative privileges, giving the code -- and thus the attacker -- full access to and complete control of the machine.

Re:But, What Now?

[Mister Whirly]

And if you are just blindly clicking "Allow" without ever reading or thinking about what you are doing, how is it anyone else's fault but your own?

Re:But, What Now?

[JackPT]

Because the current UAC implementation has counter-productive properties in the form of overoptimistic assumptions. The majority of things people install will be benign, so the UAC pop-up is something that is going to desensitise users to its importance. To get the best level of security out of Vista people will have to read Microsoft documents like Security Best Practice Guidance For Consumers. On the whole they won't. Which means that UAC's assumptions that people won't just click yes are off the mark. I don't know which world you live in, but in my world generally users don't bother reading up on security when they run Windows, which means that the importance of good security processes is obvious. The current UAC interface ensures that users will get complacent. It will, I think, be something that Microsoft will improve upon over time. A big problem with any security system is user complacency, especially with routine things that mostly present no problems. The malware isn't Microsoft's fault, but given they know their users they could do more to educating from within the OS (rather than relying on them reading technical documents from their website).

Re:But, What Now?

[Mister Whirly]

I don't know what world YOU live in, but ignoring security recommendations, not researching anything, and just clicking "Allow" without a clue to what you are allowing is not Microsoft's fault.

Will it happen all the time? Absolutely. Are a significant number of computer operators basically shaved apes without a clue about security? Absolutely. Does that make it Microsoft's fault? Absolutuely not.

How do you suggest Microsoft cures the world of dumb computer users who won't do what they are told, and what go against what common sense would dictate? Say someone bought a car, drove it until it died and then brought it to a repair shop where it was discovered there was no oil or engine coolant in it. ("Well, I saw some lights go on, but there are so many lights on the dashboard I just ignored them and kept driving.") Would it be the fault of Chevrolet because the operator couldn't be bothered to RTFM or understand how to properly operate a car before doing so?

Re:But, What Now?

[JackPT]

The point you seem to have willingly ignored is that in order to drive a car, in the real world, people have to have achieved a certain level of proficiency. Which is why the "you wouldn't blame Chevrolet ..." arguments are so weak. Computer users mostly don't have to take a test - so please don't ignore that - it's rather a large aspect of modern computing. A company that claims a product has certain level of security out of the box (would you like me to cut an paste the marketing blurb?) that actually offers a system that is no more secure than its users, is not really right in making those marketing claims. If you look at the marketing for most other real-world security products they usually say something along the lines of "Provides security if properly fitted". Microsoft say Provides Security, without the Properly fitted bit. As such its competitors in the OS market do a better job of insulating users from their stupidity. What you're arguing for is not insulating users from their own stupidity. That's fine as long as you don't market on the basis of security or live in the real world.

Re:But, What Now?

[99BottlesOfBeerInMyF]

I don't know what world YOU live in, but ignoring security recommendations, not researching anything, and just clicking "Allow" without a clue to what you are allowing is not Microsoft's fault.

And here is the fundamental misstatement of the security problem that has plagued the industry for years. Security is not about figuring out who can be blamed for failure, it is about preventing failure. If I design a system where when you run malware it says, "this program is malicious, don't run it (Don't Run)(Run) along with a graphic" but also install a method of running an electric shock through the mouse and keyboard so that every time the user clicks (Don't Run) they are shocked, have I designed a secure system? After all, if the user is clicking (Run) it is their fault right? I've successfully shifted the blame, does that mean I've designed a secure system? Hell no!

All good security design takes into account the human element. Security scans at the airport of people on a "list" are wholly ineffective because so many people are on the list that the humans in the loop become conditioned to assume they are all false positives. Likewise, providing (Cancel)(Allow) dialogue boxes that are all the same with a high ratio of false positives for every real attempted security breach is just another way to operant condition people to mindlessly click "Allow."

Does that make it Microsoft's fault?

If MS designed a security system without taking into account that most of their users are "shaved apes" then yes, it does make it their fault that it is insecure.

How do you suggest Microsoft cures the world of dumb computer users who won't do what they are told, and what go against what common sense would dictate?

Gee, they could design systems for the people that actually use them and provide those people with both the information they need to make good choices, the ability to make those specific choices, and a good user interface so that they are able to actually get the information instead of being inundated with hundreds of false positives.

The problem with Vista's security is not that "users are teh stupid." It is MS's basic premise that programs should have complete access or none, without the user being given enough information to know if they can trust that application. Any system attacked as much as Windows and run by as novice of users as Windows should provide a competitive marketplace for certification of trust and should sandbox all applications based upon that level of trust. The user should never, ever be asked to allow or deny some program from doing whatever unspecified thing it is that the program wants to do, but should very rarely ask a user if some program should be allowed to exceed the predetermined level of trust it has been given in a specified way, i.e "the program 'marsblast' would like to read your AddressBook file (Stop it from reading my AddressBook file)(Let it read my AddressBook file once)(Always let it read my AddressBook file)." If MS had to compete for users, instead of having a monopoly, they would have implemented this 5 years ago. UAC shows they still don't give a damn about security, but are willing to make a "me too" entry that is a decade late, and implemented half-assedly.

Re:But, What Now?

[Mister Whirly]

"The point you seem to have willingly ignored is that in order to drive a car, in the real world, people have to have achieved a certain level of proficiency. Which is why the "you wouldn't blame Chevrolet ..." arguments are so weak. Computer users mostly don't have to take a test - so please don't ignore that - it's rather a large aspect of modern computing."

Yes, in order to drive you need to take a test proving your proficiency AT DRIVING - not at basic care and operation of a car.
All of my users where I work also have to take some security tests before they have access to anything like medical records, etc that are protected. Tests are nice, but about as much as a "feel good" solution as the Microsoft's warnings. Does the test prove they are 100% infallible when it comes to security? Hell no. But it does cover my ass and lets the user know that a great deal of the responsibility of security rests on them and their practices.

"If you look at the marketing for most other real-world security products they usually say something along the lines of "Provides security if properly fitted". Microsoft say Provides Security, without the Properly fitted bit."

So you are saying if MS added the "if properly fitted" blurb, you would have no problems with their security claims? Somehow I don't buy it...

Re:But, What Now?

[Mister Whirly]

No matter how well of a security system MS designs, idiots will always find a way to break it.(and Slashdotters will always find something to bitch about it)

"A common mistake people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools."
~Douglas Adams.

Re:But, What Now?

[JackPT]

Actually, I would have no problems with Microsoft's security claims if they added the Properly fitted blurb. In fact I applaud their Vista features page for that reason, their security blurb on that page is excellent and is good for the user. That page is how it should be done. Their security guides for Vista are among the best Microsoft has ever produced. But in general they haven't been so good. I have never once, in all of these threads, stated that I think education is the sole answer - but as such Microsoft have done a very poor job of educating or insulating the user. They could do much better. In general I think UAC is a good thing (particularly for corporate desktops) but I think the present implementation sucks, and will probably be addressed in future versions. In fact I'm willing to bet that the present implementation was a marketing compromise rather than something a technical person pushed for.

Re:But, What Now?

[JackPT]

I think that's true, but I think the issue here isn't really one of something being wholly bad, rather the implementation. I think bitching is good, it's not like it's going to affect Microsoft's market share, and if they choose to listen to constructive criticism Vista has a good chance of been the most secure consumer operating system. One of the things Apple have done particularly well is insulate users from their stupidity, and while it's not a total mitigation it is some mitigation, which I think the current UAC implementation does badly for the reasons I've outlined elsewhere on this post. True, for some fairly legitimate reasons, people have a beef with Microsoft, but that doesn't automatically mean that all criticism is irrational.

Re:But, What Now?

[99BottlesOfBeerInMyF]

No matter how well of a security system MS designs, idiots will always find a way to break it.(and Slashdotters will always find something to bitch about it)

No matter how much progress we make in the medical field people will still die. (and AMA correspondents will always find some disease to complain about)

I guess I'm just not understanding the point of your comment. Are you saying computer geeks like us should just ignore huge security problems, and since no security can be perfect we should all just give up and stop pointing out problems? This is a forum for computer geeks. MS has poorly designed a half-assed security system. You think it would be best if we all just kept quite about it and went on about our business, rather that trying to discuss the issue? Why are you here commenting in the first place?

Re:But, What Now?

[Mister Whirly]

No, my point is the absolutely secure system you want is impossible for anyone to deliver on. What one person thinks is a completely secure usable system another thinks is full of holes and barely usable. I'm not saying complaining is wrong, or discussing security is bad. Just that satisfying everyone is impossible. There is always a tradeoff between user-friendliness and security and software developers need to decide where to draw that line. Some want it way to one side while others want it way to the other, but someone is always complaining. People need to be a little more realistic in their expectations.

Re:But, What Now?

[99BottlesOfBeerInMyF]

No, my point is the absolutely secure system you want is impossible for anyone to deliver on.

But I don't want an "absolutely secure system" as I pointed out. I want a "reasonably secure system" designed with the current malware problem in mind. 25% failure rate is not reasonable.

What one person thinks is a completely secure usable system another thinks is full of holes and barely usable. I'm not saying complaining is wrong, or discussing security is bad. Just that satisfying everyone is impossible.

Results are measurable. Simply designing a system so that a current security expert could look at it and at least think it might have a significant benefit seems pretty reasonable to me. UAC is a marginal improvement in Windows to try to bring it up to the level of security of other OS's that don't have a malware problem in the first place and thus aren't designed to handle what Windows needs.

There is always a tradeoff between user-friendliness and security and software developers need to decide where to draw that line. Some want it way to one side while others want it way to the other, but someone is always complaining. People need to be a little more realistic in their expectations.

This is a fallacy. Please stop repeating it. Security and user friendly are not diametrically opposed. Many, many security improvements also improve usability. The fact that inept security people and the general populace have seen the trend to add user unfriendly technologies as way to improve security is something MS is taking advantage of with UAC. It is obviously user unfriendly in a blatant way, so most people assume it adds security, but realistically, it adds very little. MS, however, is more interested in the perception of security anyway.

Adding false positive security alerts to a UI reduces user friendliness and reduces security. I'm taking MS to task for not giving a damn and not even really trying to solve the main problem, which is their security assumption that if a user runs it, the OS should trust it. This is quite simply not the case and the fact that MS still insists on designing based upon that assumption at the same time that they reduce user friendliness by repeating the same UI mistakes that they have been taken to task for by UI experts for over a decade means we should all be speaking loudly enough to be hard over the PR machine that this is not "good enough."

Re:But, What Now?

[seifried]

FUnny, my Mac, the Mac my parents use, the ones I see in use at businesses don't have these issues. Hopefully one day Apple will catch up to Windows and implement all these security problems so we have something to click on when we get bored of doing work or playing on the computer. =)

Re:I surprised you saw UAC at all.

[ThePengwin]

People have also speculated that this is so M$ can blame the user later. So they went through all the trouble to try and create a system which lets users know more about whats happening to tell them that in the end its all your fault if you get a virus? Why not just say in the EULA "Dont click anything, it could be a virus/worm/trojan/spy ware/ad ware. We wont help you then"? Furthermore, why does windows have so much support then? why are there updates? Its not "Deal with it yourself", its most likely "We cant protect you from it all, but we will try" As for a non free OS comment, People use non free OSes these days because they honestly dont know how things work, and wont spend the time to. Its the same reason why anyone can build a car, but noone really does.

Let me get it straight.

[140Mandak262Jamuna]

Somehow an unknown executable ended up in your temp folder. You have no idea how it did. Some application is trying to run that unknown executable every few seconds. You dont know which application is doing that. You dont know what else that application is doing to your system. But you think the UAC has saved your butt. And further suddenly all UAC dialogs stopped. Instead of asking yourself with much trepedation "why?" you become happier! "All others are getting the annoying UAC dialog. But whatever malware is in my system does not bother me with UAC, it got all the authorization it wanted."

This is what the other guy said, "Vista is designed to make you feel warm and fuzzy and happy while your machine is being rooted."

Re:Let me get it straight.

[AJWM]

Somehow an unknown executable ended up in your temp folder. You have no idea how it did. Some application is trying to run that unknown executable every few seconds. You dont know which application is doing that. You dont know what else that application is doing to your system.

You just described the normal everyday experience of 99% of people running any application on Windows. They don't know from "temp folder", and they sure as hell don't know what else that application -- whether it's Office or IE or Outlook, or some non MS software -- is doing to their system.

Re:Let me get it straight.

[140Mandak262Jamuna]

Yeah, most of them dont even know where the OS part ends and where the application starts. They have only the vaguest idea of where their machine ends and where the "internet" starts. Just last week I helped someone fix their router. Some very simple glitch. The tech support had her turn off the firewall in the machine, turn off the firewall of the router, came in through remote assistance, messed up everything. The wireless rounter encrpytion turend off. Max connection limit upped to 50. Computer name changed, work group name changed. Asking a plain simple windows box to connect directly to the modem and turn off firewall is plain irresponsible.

I get irritated when my car mechanic changes the radio station when I drop it off for oil change. And here the torture people go through tech support, incredible.

I don't know which is worse....

[StressGuy]

The apathy demonstrated by M$ or thier sheer ignorance

meh...who knows?....who cares?

{so, is this joke beaten to death yet :) }

Re:I don't know which is worse....

[bradkittenbrink]

{so, is this joke beaten to death yet :) }

I mean, I guess so... Why you gotta make such a big deal about it man?

Oblig. Simpsons

[TheVelvetFlamebait]

Lisa: We're from the MTV generation; We feel neither highs nor lows.

Homer: Wow! How does that feel?

Lisa: Meh...

Re:Anti-Virus makers, make Virus.... same old scar

[game kid]

These are the same guys that sell Mac OS antivirus through fear and can never have enough access to the Vista kernel.

Microsoft has some big problems with security, but Symantec is sickeningly desperate. I used to depend on Norton/Symantec to keep my computer from dying. Now I just want the company to die (as desperate companies sometimes do). They sound like one big Mad Money "sell-sell-sell" button, just wanting to sell something to the public for whatever they use.

Re:I surprised you saw UAC at all.

[zlogic]

The problem is that most WinXP apps need admin rights without any reason, and that's really insecure 'cause you need to be admin to do any serious work. So MS decided that running such apps should be a pain in the ass - at first it will be bad, but once developers rewrite things to works a standard user (and they will be forced to do it, or users will get mad), UAC warnings will appear when something does really need user attention.

Old Unix security issue

[l2718]

Hey -- this is simply a setuid root shell, a potential security hole as old as Unix. Apparently programmers never learn from experience. When I administer a system, a program which runs other programs based on user input doesn't get to be setuid root.

Re:I surprised you saw UAC at all.

[benzapp]

I think your signature shows you to be the zealot that you are.

UAC is not that big of a deal.

I am colourblind

[Kimos]

I don't use Vista so I don't fully understand. Do the colours of the popups provide security-related information? Seems pretty ridiculous and unfair, considering I'm not the only person in the world who is colourblind...

Isn't this the whole point of UAC?

[DavidD_CA]

So basically Symantec is saying:
    1) Sneak in a file with a virus payload
    2) Execute that file, triggering the UAC
    3) User blindly clicks "OK"

Of course, the point of UAC is to prompt the user when something is trying to run that requires admin privledges. Users know that when they see this box randomly pop up that something unusual is happening.

Unless they just said to install some software or tried to change a setting themselves, seeing this pop up when they visit MySpace or something shouldn't be a problem.

UAC is meant to provide users with an alert saying "something bad may be happening, stop it?" It's not meant to completely lock down your computer to the point where you have to log off and back on as an admin to do anything.

Re:Isn't this the whole point of UAC?

[JackPT]

The problem is that most of the time people are going to be running programs with no security issues. This will lead, given most computer users don't understand the concept of system files (let alone computer security), to people clicking yes as a reflex action. UAC is good for users who know what they're doing, the problem is that as a consumer operating system, the base users won't. UAC will be excellent for corporate use though (provided the IT administrators know their mustard).

Re:Isn't this the whole point of UAC?

[DavidD_CA]

At which point I would expect the user to go "hmm, this isn't right" and then attempt a virus scan or to stop visiting the website that keeps prompting them.

The UAC is not a magic bullet, but it is a far better solution than anything we have today. Do you have a better idea? Don't let these programs run at all?

Re:Isn't this the whole point of UAC?

[DavidD_CA]

I think the warning box that pops up (and blacks out the rest of your desktop) is pretty damn scary to most users and will make them think twice about pressing OK. (Or rather, supplying their password and pressing OK, assuming they are running on default configuration and not a system admin.)

I also think this is the best alternative to just not letting a normal user run a program at all. We have to find a happy medium between security and convinience, and I think this is it.

Re:Isn't this the whole point of UAC?

[JackPT]

It will be scary the first few times. Given that most of the stuff people install is benign they're going to rapidly become desensitised.

Re:Isn't this the whole point of UAC?

[99BottlesOfBeerInMyF]

At which point I would expect the user to go "hmm, this isn't right" and then attempt a virus scan or to stop visiting the website that keeps prompting them.

That sort of depends upon how high the false positive rate is in general.

The UAC is not a magic bullet, but it is a far better solution than anything we have today. Do you have a better idea? Don't let these programs run at all?

I'm not saying UAC is worthless, just that it is far from ideal, or even sufficient to provide the security needed by the average user. As for having a better idea, I sure as hell do. I think any reasonable security engineer who looked at Windows with the goal of solving the malware problem would conclude several things. First, Windows is attacked so much more often due to its dominance that the security mechanisms on more secure desktops, like Linux, are still insufficient to solve the problem. Second, if you look at the most secure OS's available today, they've all gone the same route, mandatory access controls. That is to say, locking down security on an application by application basis with restrictions for all resources, not just files or network ports.

Moreover, MS already started to implement a signing framework needed to bring MAC to a desktop user in a usable way and the NT kernel has built in support for the kind of ACLs needed. The answer is pretty obvious at that point. The assumption that users will know if they can trust a given application and are not going to run software that they don't expressly trust is an incorrect assumption.

MS engineers, however apparently look at things a little differently. Instead of innovating a solution to the problem or even copying the really secure systems on the market, they looked at their closest competitors and tried to come up with something that would be "close enough" to what Linux and OS X have implemented that people would not see them as way behind anymore. They seem to have been trying to solve the problem that people perceive them as insecure, rather than the problem that users cannot do what they need to do securely. UAC addresses the perception by being very visible, while not really getting there for actual security.

As for their application signing solution (a needed tool for both users and the OS to determine trust) MS's normal self seems to have undermined it by building a framework designed around lock-in, rather than one that fosters competition among certifiers of trust that would lead to really useful information. At this point, I basically have no faith that MS has the ability to engineer a truly secure solution and the only hope for MS's customers is that someone else will do it so MS can copy it.

Re:I surprised you saw UAC at all.

[99BottlesOfBeerInMyF]

So MS decided that running such apps should be a pain in the ass - at first it will be bad, but once developers rewrite things to works a standard user (and they will be forced to do it, or users will get mad), UAC warnings will appear when something does really need user attention.

Except that by default, whether it needs permission or not, installers ask for and run with admin permission. That means developers have no motivation to to stop writing installers that require administrative permissions and malware writers' trojans that ask for suck permission will not stand out even if developers did change their behavior for some other reason.

Yet another bad car analogy

[AJWM]

People use non free OSes these days because they honestly dont know how things work, and wont spend the time to. Its the same reason why anyone can build a car, but noone really does.

No.

People don't build their own cars for the same reason they don't write their own OS from scratch: it's too much work, and they don't need to.

People use free OSes for the same reason they don't buy cars with the hoods welded shut. The difference is that there's no auto manufacturer with sufficient monopoly that that they'd ever sell any cars with the hood welded shut.

Re:Yet another bad car analogy

[Beyond_GoodandEvil]

The difference is that there's no auto manufacturer with sufficient monopoly that that they'd ever sell any cars with the hood welded shut.

Speaking of bad analogies, the YYC from volvo has no hood. So it isn't that far off. Btw, a better analogy would be when is the last time you changed your own oil vs. when is the last time you recompiled your kernal.

Re:Yet another bad car analogy

[StikyPad]

People use free OSes for the same reason they don't buy cars with the hoods welded shut.

People don't buy cars with the hoods welded shut because they don't sell them, which is totally irrelevant to what OS they use.

Anyway, a) most new cars are so complex that the hood might as well be welded shut as far as the owner is concerned, b) whether or not they can modify their car is not the primary consideration for most purchasers (hint: it's something you put drinks in), c) welding the hood shut would increase labor in the event that repairs had to be made, which would increase warranty costs, making those vehicles less competitive, and d) I suspect that, despite all of that, most people would still buy Corvettes even if the hood was welded shut. True, that's purely speculative, but no less than your absurd implication that manufacturers secretly desire to weld hoods shut.

Re:Yet another bad car analogy

[Anonymous Coward]

I don't think it would be that big of deal. Whenever you take your Mercedes in for its biweekly trip to the repair shop, just tell the mechanic to change out the lightbulb while he's fixing whatever alse went wrong with it this time.

Wrong color for danger!

[A_Non_Moose]

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?


I know, red isn't the color of danger, heck if they watched Dr Who they'd know that
Mauve is the color of danger.

Sheesh, how unprofessional can you get?

Well you didn't

[dedazo]

psychotic pain

Since you've never actually used it but rely solely on the "opinion" of people who think exactly like you, I think it's safe to dismiss your opinion here? Oh, especially when you link to something you did with your sockpuppet account.

BTW, I find it hilarious that the author of that "OMFG Microshaft Winblows SUXX" wankfest complained about Vista obscuring the background. Isn't that rich? GNOME does that as well, although inconsistently. I'll let you figure out why.

Vista is going to have the same kind

I love your little zealot bullet points, twitter. "Microsoft sues schoolchildren" and "four minute half-life". Wasn't that twelve minutes though? Heh. BTW, Vista has been out for more than a year for all practical purposes, and probably has a market share that is bigger than Linux and Mac combined. Your predictions simply don't pan out, do they?

icing on the cake... will always exist... non free OS... forced to trust... despise the user... refuse... sabotage each other... systems crawling... spy and malware... Debian, is the only kind of software

twitter, you are so good with weasel words it's not even funny. Have you ever thought about running for office? You'd make a great politician. The ability to compress so much bullshit negativity and FUD into such small a paragraph is just astounding. You should seriously consider it.

Wow...

[Cervantes]

Wow...
If I can infect your system with a trojan and drop files onto your hard drive and then remotely run code, I can get you to click OK to a box that could infect your system.

Truly groundbreaking work here. Seriously, I mean, if all I have to do to possibly infect your system, is infect your system... well hell, Vista will probably be recalled!

As usual, TFA doesn't live up to the summary hype. But that won't stop the MS haters from jumping on board with a "See! It's broken!"

Really, the story for me here is "Someone infects your Vista with a bug and tries to elevate the program to Admin, and even though you're infected Vista STILL pops up a warning box... it just happens to be green instead of orange."

My biggest beef with UAC

[JackPT]

My problem with UAC is that I bought a new computer recently, with Vista pre-installed and during the initial setup it prompted me to create a user account. The user account had full admin privileges. I immediately set up a lower privilege account for general webbrowsing etc, and when using that account not only do I have UAC confirmation messages, but I also have to enter a password. That is a good thing - rather like 'su' in Unix like operating systems or Ubuntu's locked screed admin method. Users just aren't going to realise the importance of what they're doing with just binary yes or no security questions. If anything with the initial account defaulting to admin, Pavlov's dog like, they're going to be conditioned to hit yes without thinking. People aren't paranoid even though people are out to get them.

To rectify this problem Microsoft should make it clear during installation that the initial admin account shouldn't be used as the main account. This is not clear during the installation.

Good things:

- Internet Explorer's protected mode.
- Making sure the heap is in a different place on each computer.
- UAC is good for experienced or computer literate users (nobody else.

Bad things:

- UAC, in its present form, is just training computer illiterate people to click yes. There is an emphasis with a consumer operating system to educate the user. Not necessarily enforce (that would restrict freedom) but it should educate. All or nothing is not good.
- Idiot reviewers thinking that an operating system is the largest contributory factor in the speed of a computer. Saying Vista is faster than XP when it's been run on a new, much faster computer, is a little like trading a saloon car for an Aston Martin and saying that the Aston Martin is faster because of the upholstery.

Re:My biggest beef with UAC

[Man in Spandex]

- UAC is good for experienced or computer literate users (nobody else.

Yes and no.

Maybe if UAC was less repetitive when first configuring Vista I'd agree, but to turn it off and then turn it back on when configured proves that computer savvyists don't need it, but afterwards it may save our butts when we'll one day accidentally run an executable but get a warning.

Computer illiterates on the other hand, they get bloatware on IE cause they click yes to accept and run any ActiveX and certificate bs so they'll do the same for Vista. OR, everytime a popup appears they'll give us computer literates a call and go "HEY JOHN, DO YOU KNOW WHAT THIS POPUP MEANS? I'M SCARED!" :|

Re:My biggest beef with UAC

[SanityInAnarchy]

but I also have to enter a password. That is a good thing

As far as I know, anything on the system can create something that looks like a valid UAC box, dim the screen, etc. Certainly, I'd imagine this to be the case on OS X or Linux (with sudo or whatever). So, with just a simple yes/no dialog (or allow/deny), you can click "yes" on anything, but it's only a problem if you click "yes" to an actual UAC box without reading it. They can spoof a passwordless UAC box all they want, but if you don't click "yes", it won't do anything.

However, if they popup something that looks identical to a UAC box, but captures your password, well, they now have your password. Certainly this is a problem on Linux/OSX, as su (and sudo) don't really attempt to go farther than making sure they're reading directly from a terminal -- usually a pseudoterminal, meaning it's just a bit more annoying to find a way to pipe a password into sudo.

So, without doing the research, my question is:

• Do you have to hit ctrl+alt+del to enter that password? Because generally, ctrl+alt+del is not interceptable, and if it's not expecting a password, it'll take you to another screen, and you'll know the box was fake.
• Is there a way to authenticate without Windows forcing it to be a real, physical keyboard/mouse? Seems to me the attacker could always rdesktop to localhost or something like that, but if the only place Windows accepts your password from is the keyboard (a major PITA for things like VNC, for those who prefer it to rdesktop, or if rdesktop is broken), then I suppose an attacker knowing your Windows password isn't really a security risk.

Re:My biggest beef with UAC

[JackPT]

It would be interesting to know how easy it is to spoof the dimmed screen, you don't have to Ctrl-Alt-Delete to enter the password. I think you've raised pertinent questions. Without getting into the nuts and bolts, which I hope to do in the following weeks, I would rather defer the question to others. However it should be more difficult: http://blogs.msdn.com/vishalsi/archive/2006/11/30/ what-is-user-interface-privilege-isolation-uipi-on -vista.aspx IIRC the UAC prompt operates in something called the secure desktop which would also have to be compromised. The devil is in the detail though, so I'll hedge my bets.

Re:My biggest beef with UAC

[SanityInAnarchy]

the UAC prompt operates in something called the secure desktop which would also have to be compromised.

All that means is that you have to avoid a UAC prompt. Spoof one to get the password, then use another means of privilege escalation which will work with a password but not UAC. I'm not sure such a thing exists, though it would kind of have to on any machine with remote desktop enabled.

However, since you say you don't have to ctrl+alt+del to enter the password, that means it's too easy to get said password. Even if it doesn't give you access to the local machine, it becomes a problem unless it's a very unique password.

Doom!!!

[Anonymous Coward]

Come on, we've all played Doom. Are you honestly going to trust something named UAC?

Re:I didn't think it was that difficult

[Strudelkugel]

  From what I understand, the UAC thing comes up all the time

It does not.

I'm rather amazed at the number of posters who criticize Vista without having used it. Many people make good points about the all-or-nothing permission granting of the UAC, but it is better than having people run as Admin. My guess is that the typical user will still run as admin most of the time, since it's convenient. Microsoft should guide people through the simple steps of setting up a user account when the OS first comes up. It's less hassle than typing in the license key. Then again, I don't have a boxed version of Vista, so maybe they say something about that in the retail version.

Re:I didn't think it was that difficult

[PitaBred]

"Dude, how can you say HIV is bad if you haven't ever had it? Why would you listen to other people who do have it?"

Extent of Microsoft's duty

[Beryllium Sphere(tm)]

Should an operating system handle normal and predictable events without data loss or incriminating the customer?

Let's jail the malware authors no matter what, but let's face it, attacks on Internet-connected machines are as predictable as rain in Seattle. Seattle homebuilders aren't allowed to leave off a roof and then say "what, you expect me to control the weather?".

A computer is a software player, its value comes from being able to install and run software. If it runs a web browser, it runs Javascript software without even asking the user.

A company with thousands of engineers and a large research department should have figured out, somewhere around 199x at the latest, that giving every program all the rights of the logged-in user (and compelling a root login at that) was an obsolete idea.

Re:I didn't think it was that difficult

[dnoyeb]

I think what is most unfortunate is some businesses will disallow the ignore setting and make you endure these popup warnings until hell freezes over.

Re:What's the issue?

[Herby Sagues]

Either I don't know anything about computer segurity (odd as I get paid for that) or these guys don't know anything about security (odd as THEY get paid for that). In order for this "hack" to work the user has to download malicious code from the Internet, run it and accept a warning that indicates there's a dangerous elevated operation going on. How is this a hack in any way? Normally, if the user ran malicious code on Vista and it tried an elevated operation, it would trigger a warning. If the user accepts the warning, the code is run elevated and the computer becomes damaged. That's how it is designed to be, and that's even more than most platforms do in this respect. In this situation, exactly the same applies. The user has to download the code, run it, and accept a security warning. So where's the hack? A real hack would be to prevent a security warning from raising, not to raise a security warning when one is granted (or not).

Re:What's the issue?

[JackPT]

I think it's more a case of a hack that allows misrepresentation, after all it doesn't escalate privileges or straight out compromise the system. But in combination with the standard social engineering as seen on most malware sites it should be classified as a hack.

Wait a second

[Joebert]

Next, the malicious code would drop a malformed .dll file onto a part of the hard drive that the user, who would presumably be running as a restricted Standard User

As soon as the user clicks the "Confirm" button, the malicious code is granted administrative privileges

Since when do restricted users get to delegate administrative privlidges ?

Re:Wait a second

[Joebert]

Oh yeah I forgot, since Windows 95

Re:Wait a second

[Kalriath]

They don't. Restricted users can only delegate administrative priviledges by entering administrative credentials to a UAC prompt. Stop with the bullshit FUD.

Re:Wait a second

[Joebert]

Well if they're a restricted user, what are they doing with administrative credentials ?

Re:Wait a second

[Kalriath]

Precisely. If the sysadmin isn't braindead, they don't. And Symantec's whole argument goes out the window. I know that with computers in my house, the XP machine I don't use is used by a person who couldn't log in as an admin if they tried. Don't know the domain admin password you see. My own machine is a Vista machine with UAC left enabled. I get less than one message from it per week.

If you ask me, this has something to do with Symantec creating a UAC product. From TFA:

Symantec executives talked up research it was doing on UAC, which may result in software to give users more control over how frequently Vista pops up the alerts. Whitehouse denied that there was any connection between his research and possible UAC-related product plans Yeah right.

Re:Wait a second

[Joebert]

Now that makes sense.

I would say...

[Belial6]

I would say that the number of kitchen fires every year contradict your point.

On a more serious note, we already have computers that are appliances. They are call DVD players, CD players, TVs, Alarm Clocks, Coffee makers, and yes, sometimes toasters. The reason that computers will never be built like appliances is that when it is, it is no longer called a computer. Just look at the mythical "Video Game Crash". People will argue all day long that all the people shifting to full fledged personal computers don't count as video games because a console is not a computer. Now a rational person knows that it is. The Atari 2600 had computer right on the box. It even had a retail programming language available. Unfortunately, rational people are in the minority, and don't necessarily get to pick the definitions of words. So, until you can convince most people to consider their TV that has a more powerful CPU than any PC of the early to mid 80's, a computer, it will be physically impossible to make the PC into an appliance. Heck, you could start by just convincing people to consider their game console a computer.

Re:UAC?

[SanityInAnarchy]

Am I the only one who sees UAC and thinks "Union Aerospace Corporation".

It does seem appropriate -- they both are directly responsible for all Hell breaking loose.

I wish Slashdot was like Digg...

[SanityInAnarchy]

...because Parent deserves far worse than a -1. Cap us at "+5, Insightful", but let us mod people "-12835, Flamebait"

Re:I surprised you saw UAC at all.

[jacksonj04]

Correct. You *MUST* be an admin to install an application system-wide. This is completely logical and I wouldn't expect any less.

If, on the other hand, you write a user-space application for Vista it will install quite happily just for you. Try it.

Huh?

[16K Ram Pack]

The process to spoof a UAC dialog is roundabout, but doable, said Whitehouse. It would start with a user falling for any one of the current hacker tricks. "The most likely scenario is that a user gets compromised by malicious code, from a Trojan [horse] or a vulnerability in a third-party application like Office or a browser," he said in an interview.

But presumably that also has some sort of UAC when you try and run it?

Who cares about this if you've already compromised the security? anyone else think that Symantec are getting nervous?

Since We're Doing Car Analogies

[gyrogeerloose]

Their security guides for Vista are among the best Microsoft has ever produced.

That's sort of like saying that the Yugo GVX is the best car that Zastava ever produced. Yes, it may be true, but...

Re:Since We're Doing Car Analogies

[JackPT]

Heh, but they're being quite reasonable:

http://www.microsoft.com/windows/products/windowsv ista/features/details/useraccountcontrol.mspx

It's just that the majority of users aren't going to read that, or the quite reasonable consumer security guidelines. They can fix that by linking to guidelines (like the guide linked at the bottom of the above page) as part of the UAC warning. They won't though, because some marketing type will worry that it will alienate non-technical users. I don't think UAC is a bad thing, it's just a sucky implementation. This is in-part down to non-compliance of applications, but I think the blame there lies dually with Microsoft and developers that claim their apps are Vista Ready.

Re:I surprised you saw UAC at all.

[drachenstern]

Except I believe that you have overlooked the fact that many people who package and distribute their software use only one of a few installers, such as the nullsoft installer. So actually only a few groups have to change their installer behaviours and then the developers and distributors need to migrate over to the new system.

So yes, developers will have to have some motivation, but that should be nothing that a few successful slashvertisements and diggs wouldn't be able to handle

Re:What's the issue?

[Darundal]

Actually, I think that this is either a) Proof of Concept or b) something that a trojan would do...

Re:Importance? (crying wolf)

[JackPT]

The secure desktop, as used by the UAC, doesn't require Ctrl-Alt-Delete. That was removed somewhere during Vista's testing process. In fact pressing control alt-delete stops the UAC process, and takes you to a screen that allows you to switch user/launch the taskmanager etc. so a spoof program would present exactly the same behaviour except it wouldn't exit after pressing Ctrl-Alt-Delete. That's not a distinction most users are going appreciate.

The problem with the UAC prompts is that people are going end up pressing yes as a reflex action. In part because most applications are currently not entirely very Vista friendly, which means they invoke UAC (sometimes unnecessarily) an awful lot. This is not entirely Microsoft's fault.

But, you're right, preventing spoofed authentication dialogues is something most current desktop OSes suffer from. It's just that Vista currently liberally displays the dialogue, which I believe will have a counter-productive effect. Crying wolf.

Are those the only choices ?

[RockDoctor]

Vista's User Account Control, love it or hate it,

Isn't there an option to be utterly disinterested due to the unlikihood of seeing it for years to come?

Followup on colorblind users

[mattr]

I read a post by a colorblind user above and looked it up here.

I thought it was only red/green though in fact it can cover a whole bunch of colors, and apparently at least 1% of the population has color blindness of some type.

It strikes me that Vista's use of green, red, orange, gray, etc. are totally underminded by colorblindness which can confuse colors, dim them or render them conceptually meaningless if I understand the article correctly. Seems like the dialogs should include a mode name too.

Re:Followup on colorblind users

[avanaardt]

Didn't MS make a big stink last year about how OpenOffice was not friendly to disabled people? And now....?

Re:I surprised you saw UAC at all.

[99BottlesOfBeerInMyF]

Correct. You *MUST* be an admin to install an application system-wide. This is completely logical and I wouldn't expect any less.

You're missing the point. By default all installers ask for admin permission and run as admin. If you download an installer, you have to go out of your way to run it as a normal user, which people simply aren't going to do. Thus, there is basically no motivation for developers to write installers that do that. Further, since MS has not provided an official non-admin service for handling licensing of software, developers have a lot of motivation to keep doing the same thing they have been.

Re:What's the issue?

[Flendon]

So where's the hack? A real hack would be to prevent a security warning from raising, not to raise a security warning when one is granted (or not).

To be more specific than the other replies:
Vista's UAC display has four different colors that warns a user how dangerous the action is. The hack is that the malicious code should display a yellow-orange - unsigned/unknown source - but instead displays green-teal - Vista. By displaying an elevated level of trust it makes social engineering easier.