Slashdot Mirror
Coding Around UAC's Security Limitations
Mariam writes "Free software developers from the non-profit NeoSmart Technologies have published a report detailing their experience with coding around Windows Vista's UAC limitations, including the steps they took to make their software perform system actions without requiring admin approval or UAC elevation. Their conclusion? That Windows Vista's improved security model is nothing more than a series of obstacles that in reality only make it more difficult for honest ISVs to publish working code and not actually providing any true protection from malware authors. Quoting from the post: 'Perhaps most importantly though, is the fact that Windows Vista's newly-implemented security limitations are artificial at best, easy to code around, and only there to give the impression of security. Any program that UAC blocks from starting up "for good security reasons" can be coded to work around these limitations with (relative) ease. The "architectural redesign" of Vista's security framework isn't so much a rebuilt system as much as it is a makeover, intended to give the false impression of a more secure OS.'"
Basically, all they had to do is split the thing into a front-end "userspace client" and a back-end "service".
Gee, sounds like a daemon that can be controlled from an application to me.
The article uses a play out of Microsoft's playbook for Vista compatibility -- break an application that requires admin privileges into two parts: a privileged service and an unprivileged UI. Nothing to see here, move along.
I agree. This is so utterly not a hack that the article comes off as almost ridiculous.
In fact the first response where it was announced is:
Uhh... I'm running an admin application on startup automatically all the time, there's no need to create a service or anything. Just use the Task Scheduler to start the application, Trigger=At log on; And select "Run with highest privileges".
MS had NEVER set out to prevent elevated applications from running at startup.
With respect to the iReboot team (who seem to have written a pretty nifty piece of software and certainly know their way around programming), there is so much spin on this article that light passing near it bends.
The "Gory details" portion of the article gives a pretty good explanation of the work they had to do to make iReboot access high-permission OS features via a low-permission client. I have no idea how they got from there to "Any program that UAC blocks from starting up 'for good security reasons' can be coded to work around these limitations with (relative) ease." What they seem to be missing is that there was an installer in the loop---an installer that requires admin privileges. This is exactly the part of the process that UAC is trying to force upon Windows developers!
The most significant problems with the Windows XP security model are as much social as technical. Because the model didn't make it easy to get "serious work" done as a non-administrator, most people are running as administrators most of the time. This creates a whole culture that is very vulnerable to social engineering---simple games are being run at the same permission level as complex drive-recovery utilities and keyboard loggers.
By having people run low-privilege by default and escalating when necessary, the UAC model forces developers to be a little clearer about what their applications are doing (since things that "just worked" in WinXP now require permission in Vista). My understanding is that the way iReboot works now is the way it should always have worked, under the Windows OS model; the fact that it also worked if the user were running as an administrator was a happy accident. How well did the old iReboot work if I wasn't running as an administrator? If the answer is "It didn't," then, well, maybe they were doing it wrong the whole time.
UAC has some problems, but the fact that it puts more work on developers isn't one of them. The work is necessary because it is accounting for a weaker security model from the past. And developers should know that security isn't free.
Take care,
Mark
There is a solution...
Dude. You just create an event in your control, and implement a scripted handler on the page. Not exactly rocket science.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
2. The part in your link that nicely sums up NSA's contributions:
The NSA also declined to be specific but said it used two groups -- a "red team" and a "blue team" -- to test Vista's security. The red team, for instance, posed as "the determined, technically competent adversary" to disrupt, corrupt or steal information. "They pretend to be bad guys," Sager said. The blue team helped Defense Department system administrators with Vista's configuration.
I can't see anything wrong with that...
Regardless, to get that privileged process running to 'circumvent UAC', don't you have to be privileged to begin with?
No, because MSI runs privileged and is able to install such processes at the command of normal users - that's the hole. You get one prompt, at installation time.. but I've never seen a windows installer that *didn't* prompt for elevation. Contrast with Unix based systems where installing apps as a normal user is the norm and installing as root is an exception (indeed with OSX each user has a full set of directories for this by default, and it's rare for something to require elevation.. when it does you definately think because it's unusual).
Actually I thought your comment was 100% accurate.
If I write a service that allows any user to write to any location in the filesystem (entirely possible on any OS - for Windows, I install a LocalSystem service, for *nix, I install a daemon that runs as root) then that service has a security hole in it, and it can be used to elevate privileges from normal user to admin/root.
That's a flaw in the service/daemon, not a flaw in the OS.
Unless you were saying that you don't know if this app has a security flaw like the one I described above.
What the site describes in neither a loop hole nor a work around: :) )
1. This is the _PROPER_ and documented way to add elevated applications
2. Adding such applications can not happen _WITHOUT_ the permission of an administrator (the installer in their case)
3. This is the same in Linux/Unix (For all Linux/Unix lovers
So don't blame UAC for being insecure - which it is not.
The only annoying feature in programming UAC is that you cant elevate from within a program. You either need to start the program with elevated rights (using a manifest) or use elevated COM components (which is more or less the programmatic way).
If you are annoyed by the frequent prompts - you can enable auto elevation using the security policy editor. UAC + auto elevation is still much more secure than UAC turned off.
BTW, Ubuntu has pretty much the same behaviour
I'm sorry, but Microsoft does NOT sell UAC as a "security framework" or a "security model" or even a security boundary, as the article claims. It's a convenience tool that makes it easier for you to run applications as standard user, that's IT. Anyone that claims UAC has ANYTHING to do with security has absolutely no clue what they're talking about -- and I challenge you to show me Microsoft documentation that speaks of UAC as a security boundary.
From TFA: "Microsoft can claim that Vista blocks system-modification tools from running at startup;" -- again, I'm sorry, but Microsoft does not make this claim. The steps that the developers of this product (admittedly a good one) are perfectly in line with what I'd expect a system of this nature to do: run as a service. That's *exactly* what services are supposed to be: administrative-level daemons that must launch on startup and are independent of the user account (or always require high privileges). Microsoft does not block applications requiring admin access from starting up for SECURITY -- it's done because otherwise, your computer would be stuck on the secure desktop waiting for authorization, and anyone possibly depending on the application (and anyone else also requiring elevation -- AFAIK, the AppInfo service can only request one elevation at a time) would also be frozen.
I don't see what the big deal is. I run OS X on my desktop and I see plenty of similar applications running as services, in fact, I'm pretty sure Apple's guidelines also don't allow for applications that require root access to prompt for credentials during the startup process. It's just bad user experience.
Why the hell do they need to run as admin as the first place? On unix, everyone wants to run its software as non-root and some people even code protection to exit on startup if the user is root. The problem here is not the user, neither UAC, it's the software developers. In order to trigger UAC, they must be doing some funky *wrong* things.
This is just a huge security hole that infects your computer when the software is installed. If they did anything simple as a 'ReadFile' as the privileged user, and that you can trigger the daemon to execute it, then it just compromised your system.
So instead of creating various, new, security issues, just fix your damn software please.
in Vista, logging in as admin does not automatically gives all the scripts and programs that you execute with the admin privilege, you will need to explicitly run your programs with elevated permissions. try right-click on the program and run-as admin or in command prompt use runas command