Mac Malware Evolves - No Install Password Required

An anonymous reader writes "The latest versions of the Mac Defender malware attacks no longer require users to enter their admin credentials (username and password) upon install. A threat called 'Mac Guard' installs itself into areas of the Mac OS X system that only require standard user privilege. On Windows the criminals did this to avoid UAC warnings, and have copied this trick to their Mac OS X releases."

Comments

Root access not needed

[mms3k]

I always find it stupid that even here people say that malware on Linux would not be able to gain root like in Windows. Spam bots, fake antiviruses, password stealing nasties and so on run perfectly fine under normal user account. There is no reason why they would require admin privileges. All the personal files are accessible on normal user account and spam can be send without root too. Sure, it could hide a little bit better if it had root access, but there's plenty of tricks to pull out under normal account too. It's like a guy making everything overcomplicated by thinking how he needs to act like a perfect guy and take the girl to a fancy restaurant and many dates before having intercourse with her. Sometimes it's just easier to go for a ladyboy - a woman with mens desire for sex. Requiring access to root account would be more common situation with something like hacking servers since you need to modify logs and really hide in the system. Most likely you also need to get access to HTTP ports and under Linux you need root account for those. But malware runs perfectly fine under user account.

Re:Root access not needed

[CharlyFoxtrot]

It's an ongoing joke, he's been challenged to use the word "ladyboy" in every comment he makes.

No surprises here

[betterunixthanunix]

...is anyone actually surprised by this?

Re:No surprises here

[Low Ranked Craig]

Not really. And I wasn't really surprised to find that this is a slashvertisment. Sophos makes anti-virus software for Macs. I prefer to get my news from someone who doesn't have a vested interest in selling me stuff directly related to the content of the article.

Re:No surprises here

[Low Ranked Craig]

Follow up. I find it interesting that they gloss over the fact that to completely avoid this all you need to do is turn off download safe files in safari, and/or not be stupid. Their solution is to purchase their anti-malware package for Mac. Question for samzenpus, how much did these guys pay you to post this?

Re:No surprises here

[gad_zuki!]

How about the comments in the last article from the fanboys screaming "BUT THEY NEED TO PUT IN THEIR PASSWORD UNLIKE SHITTY WINDOWS" and then modded up to +5 insightful.

Welcome to the new reality. I think they'll find that userland rights on any modern OS are pretty lenient and will allow for a great deal of scammy malware activities. Malware doesnt need to run in any system directory or open any low ports or anything.

Now is probably a good time to invest in OSX AV products.

Re:No surprises here

[gad_zuki!]

That's a little like saying "Oh just run noscript or make disable the java plugin" in the Windows world. Most end user have no clue what "safe files" are or what any of what you wrote means.

Not to mention, any web based exploit can install this malware now. It runs purely in userland. Java exploits, flash exploits, browser exploits, etc open the gate for this malware. Today its the safe files in Safari, tomorrow its one of dozens of Java exploits.

Its simply easier for end users to do updates and buy an AV than to dick around with settings they don't remotely understand. To Apple's benefit they're usually good about software updates and also update Java (at least for now).

Re:No surprises here

[CharlyFoxtrot]

That policy has probably changed now since Apple has publicly acknowledged the threat and announced a fix, as well as publishing how to remove it. That's their M.O. : nobody gabs until word comes down from the mother-ship.

Re:No surprises here

[thoromyr]

not just that, but the sophos article glosses over the fact that you still get

1. an operating system warning about executing a file downloaded from the internet (complete with reference to where it was downloaded from). They mention it in the text, but omit it in their "slideshow" showing the steps to getting infected.

2. an osx installer gui which means it can be canceled

What this is *not* is a hidden and silent install like what is going on with Windows.

Re:No surprises here

[elrous0]

You get those kinds of warnings in Windows too. Doesn't stop an idiot from being an idiot, though.

Re:No surprises here

[amicusNYCL]

I find it interesting that they gloss over the fact that to completely avoid this all you need to do is turn off download safe files in safari, and/or not be stupid. Their solution is to purchase their anti-malware package for Mac.

So you're under the assumption that if you disable this particular setting, then you are now immune to all present and future malware on a Mac, correct? That proactive things like anti-virus or malware scanning are unnecessary, right? That the entire Mac malware threat ends with a single checkbox, is that about it?

You realize that nearly every time a piece of malware comes out for Windows that there's typically a single setting you can change to mitigate that one specific threat, right? Has that fact stopped criminals from finding new infection vectors?

The news here is not this one piece of software, or how it gets installed, or what it does, or how to stop it. The news is the fact that the professional malware authors are now targeting Macs, and they have the automated toolkits to do it. A little checkbox in your browser isn't going to change that fact.

Re:No surprises here

[cavreader]

So the Windows community is to blame for lax user practices on a Mac OS? This current piece of MAC malware is only the beginning. And the reason the number of compromises will continue to grow is that for years MAC users have been told that the MAC OS is totally immune to viruses, trojans, and all the other threats floating around the web. The surprising thing is the number of techies who seem to be under the impression that the MAC OS security framework is invulnerable and there is nothing to worry about. The criminals know there is a ton of money to be made going after OS X, iOS, and all the different permutations of the Android OS. Plus Windows security has improved greatly since the days of Win95 and IE6 making the number of potential exploits harder to take advantage of. Windows users have also been pounded with security notices and updates for years and that has also helped raise user awarness. I have also wondered how much easier it would have been to create exploits for the Windows OS if Microsoft had open sourced it. It will be interesting to see if open source will encourage more people to target Android in the future.

Re:No surprises here

[TheLink]

Uh, guess what windows users do to install this:
http://en.wikipedia.org/wiki/MS_Antivirus_(malware)

So they just have to mod it to show OS X style graphics and messages if they detect the OS is OS X.

Once there's enough news in the media about Macs getting infected, victims might ironically install the malware to protect themselves from it :).

Re:No surprises here

[michelcolman]

Actually it says "open safe files after downloading". And specifies "Safe" files are movies, pictures, sounds, pdf's, text documents, disc images and other archive files. Nothing about running anything. And indeed, users are always asked for permission before actually "running" any code: the installer is just Apple's installer parsing an install script, and if that script contains any customized code, it will ask you for permission to run that too.

But all that is of course under the assumption that no exploits will ever be developed for, say, pdf.

Re:No surprises here

[Low Ranked Craig]

It's not the same or even close. Open Safari, from the Menu -> Safari -> Preferences. On the first page un-check "open safe files after downloading". The point being that if this was truly an informative article and not an advertisement they could have included this little bit there. Having that option checked is a prerequisite for this exploit.

PEBKAC

[Hatta]

This still requires the user to deliberately install the malware. Since it's not compromising the system, but the user, it doesn't need privileges to do this.

Re:PEBKAC

[Anonymous Coward]

Comments like that make me think you are not participating in the two minute hate.

Just embrace the hate of apple and join the group think.

Re:PEBKAC

[Ryanrule]

So, you are saying the computer is fucked upon purchase? FUP?

Re:PEBKAC

[Talderas]

On a somewhat-unrelated note, it still blows my mind when enterprise level IT still has users with full admin rights over the local workstation, as those machines constantly and continually get infected and reinfected through the ignorance of the users. Sure, it means that a user can add a local device more complicate than a printer without calling the helpdesk, but it also means that any piece of unauthorized software, whether the user intended to install it or not, or whether it's benign or malicious, gets on to the computer. When the IT department sets up the computers and privileges properly, and if the OS doesn't have local root exploits so large one can drive a Mack truck through, the user can do a lot less damage.

It's not entirely unsurprising. Telling the company owner that "We need to change the level of permissions everyone has on their machines, which means they won't be able to do this, this, and this." after the company owner and the entire user base is accustomed to having that level of permission doesn't typically get a go ahead flag from the company owner.

Re:PEBKAC

[BitZtream]

Just putting itself in the Applications directory doesn't do anything special, users still have to run it. The Applications directory isn't setuid or anything like that, it doesn't make the app run as root, it doesn't have anything to do with startup or anything else, you're just allowed to create files in the Applications directory.

As I pointed out elsewhere, the intelligent thing to do would be to install to the users home directory as most non-techie Mac users will NEVER look in their home directory and notice it, thats just someplace they don't generally have to go, thats what the Documents, Pictures, Music and other folders are for. Unlike the Applications directory where users are bound to be looking at least once in a while.

The end result would be the same, all its going to do is effect a single user.

Now if it was intelligent, it'd modify the plist of an existing app to take itself on as the app launcher, then start the real app itself, which would possibly be used by other users on the system. You wouldn't be able to do it to the Apple builtin apps as permissions still require you to be root to modify it, but some other app the user installed will be owned by them and modifiable.

Back when they were asking for a password, they should have been installing a kernel extension to cloak themselves and make removal without booting from a clean drive impossible.

This 'malware' is like most Mac users, its a joke, its not even a little bit impressive, it just happens to be the first one noticed.

Just wait until the Windows malware writers start putting some effort into OSX, THEN it'll get nasty.

Re:PEBKAC

[Lumpy]

Stop bringing truth and facts into this.....

Re:PEBKAC

[not-my-real-name]

This 'malware' is like most Mac users, its a joke, its not even a little bit impressive, it just happens to be the first one noticed.

Maybe we can say that using a Mac damages the brain so much that even the malware writers can't do a good job.

Re:PEBKAC

[makomk]

This still requires the user to deliberately install the malware.

Something like 97% of Windows malware infections these days are caused by users "deliberately" installing malware, and that's with Windows putting a lot more obstacles in the way of websites wanting to convince users they should install something malicious than Mac OS X does. Doesn't stop Windows malware infections from being a big selling point for Macs. (Even in the bad old days of Windows security, an awful lot of infections were due to users agreeing to install the malware.)

Re:PEBKAC

[Skuld-Chan]

The end result would be the same, all its going to do is effect a single user.

Until that userspace malware exploits something to elevate itself to root.

Just because it starts as a limited user doesn't mean it won't go somewhere :).

Re:PEBKAC

[psydeshow]

The end result would be the same, all its going to do is effect a single user.

Can we retire this meme?

Nobody besides IT gives a shit if the trojan can hack into the kernel or system libraries. If it can run in user space it has access to my contacts, my photos, my browser history, my bookmarks, my email, my music, and pretty much every-fscking-thing I care about on the computer. It can send mail as me, post to websites as me, drop files in my downloads folder, and put stuff on my desktop.

I mean, great that it can't infest drivers and start servers below port 1024. But the primary user of the computer (the non-admin shlub who actually needs to get work done) is infected.

Re:PEBKAC

[ninetyninebottles]

Something like 97% of Windows malware infections these days are caused by users "deliberately" installing malware...

Citation please. When last I had access to real data, automated worms accounted for about 50% of infections. That was some time ago, but if you're making an assertion about this, a source is necessary.

I am safe.

[Anonymous Coward]

My PC can't get Mac malware.

Re:I am safe.

[BobNET]

You laugh now, but it's only a matter of time before PCs become popular enough that malware writers start targeting them instead.

Re:I am safe.

[jalefkowit]

That's because Windows is the hipster OS! It had malware before malware was cool.

Re:I am safe.

[amicusNYCL]

Really? A Mac is not a personal computer? What kind of device is it, then? Perhaps a "different computer"? Also, why does the definition of what a Mac is relate to how long someone has been in a coma? Surely the presence of recently-comatose patients would not change the nature of the machine itself.

Re:I am safe.

[drinkypoo]

Really? A Mac is not a personal computer? What kind of device is it, then?

Steve's computer.

Re:I am safe.

[amicusNYCL]

It is a computer that is personal, not a Personal Computer.

"A computer that is personal".. that's the same thing as a personal computer. So a Mac is, in fact, a personal computer. So it's not incorrect to refer to one as a PC, if you're into the whole brevity thing.

I know you and the dumb-shits wasting mod-points on this conversation are not this ignorant.

You're right, I'm not ignorant, I just don't base my definitions on marketing drivel, thank you very much.

Re:I am safe.

[amicusNYCL]

My goal has nothing to do with karma on Slashdot, I'm pretty sure it's already as high as it can go (half the time I don't even see scores next to anyone's posts, I haven't bothered to look into why). Yes, I checked the link. I realize that people commonly use "PC" to refer to Windows, for whatever reason. That still doesn't mean that it's incorrect to refer to a Mac as a PC. We've established that a Mac is in fact a personal computer. How much longer did you want to argue about this?

Re:I am safe.

[amicusNYCL]

Didn't say Karma, I said the word Insightful next to your post.

If that was something I cared about, you would probably see me quote my own posts in my signature.

I'm not confused about anything here. I don't go around referring to my computer as a "tower", I don't refer to all soft drinks as "a Coke", and when I'm talking about a particular operating system I just name it instead of using ambiguous terms.

Less damaging

[CharlyFoxtrot]

So that means it's now running with only user privileges instead of admin rights, which seems like a slight improvement for those dumb enough to install it.

Re:Less damaging

[0123456]

So that means it's now running with only user privileges instead of admin rights, which seems like a slight improvement for those dumb enough to install it.

Not when it logs your banking passwords and sends them to the Russian Mafia. Most of the things that malware wants to do can be done in user mode as well as admin.

Real issue

[Anonymous Coward]

The only real issue is the "auto-download safe content" default option in Safari.It should'nt be enabled by default. Just uncheck it.

Another case of iClicitys (rush of advertisement clics generated by apple buzz)

The difference

[wandazulu]

So instead of installing into /Applications, which does require an admin username and password, it now likely installs somewhere in the user's home folder, which doesn't require admin authorization. This means the problem would be isolated to that particular user's account.

Re:The difference

[betterunixthanunix]

This means the problem would be isolated to that particular user's account.

For many home users, that is all that really matters. We are not talking about an enterprise setup here, we are talking about some person's laptop. Frankly, in an enterprise setup I would be surprised if user home directories were not mounted with noexec (or whatever such an option would be called in Mac OS X), which would thwart this problem.

Does the principle apply to Linux?

[G3ckoG33k]

Does the principle apply to Linux? If yes, then it matters, for nerds, for real. ;)

This is the evolution of criminality

[hellfire]

The malware is evolving from taking advantage of bugs in Windows, to social engineering. I had malware scanning on my PC because malware could get in the back door via services and other areas. Now, they are installing it right in front of your face trying to masquerade as something else.

They are going from the thief in the night who exploits the bad lock in the back door, to walking in the front door acting like the delivery man and given the run of the building by unsuspecting human beings. They are no longer exploiting Windows or Mac OS X... they are exploiting the users directly and making it look like it's the OS's fault.

I've seen plenty of PCs pwned by this type of malware, and it wasn't Windows fault in those situations either, the user simple installed something that took over the system.

Re:This is the evolution of criminality

[JSBiff]

I think another point might be that the malware is evolving from doing things which might require system-wide admin privileges, to just doing things which require lower levels of access.

My first thought when I saw an article posted on Ars Technica yesterday, about this change in the malware, was, "But, wouldn't that mean the malware has to run at lower privilege levels"?

Then I realized that something running at "user" privilege levels instead of root, can still be bad. It could probably still keylog that particular user's credentials when going to websites and such. It could still send out spam emails as the user. It could still search through the user's personal files looking for anything "interesting" (or just uploading them en-masse to another 'owned' machine). It could still act as an online file repository for child porn, terrorists, organized crime, etc. It could act as a webserver for a phishing attack.

It could be used as part of a DDOS, or as part of a massive computation network (think something like World Community Grid for organized crime - to, e.g. brute force recover encryption keys for someone or some system the criminals are targetting).

Re:Apple is patching anyway

[geekoid]

Or they want to infect a trusted file, or more likely, the user info they want will resides in the users directory.

For the most part, modern attackers don't want to damage your computer, they want to get personal info. CC numbers and the like.

IT's best for them if there attack as no noticeable impact on a system.

Re:More damaging for Apple than most think...

[Shados]

The vast majority of Windows infections also come from viruses that "must be installed". Not 100% obviously, but if you take out the ones that infected users months after patches were released, and the ones where users clicked through a UAC prompt to install anyway, you end up with a very very small sample.

Its all about social engineering now.

Good News for the App Store

[vwjeff]

This just gives Apple one more reason to force all application installs via the app store in future versions of the OS. The other reason of course is money.

Re:Good News for the App Store

[CharlyFoxtrot]

It'll never happen. A lot more mac users are power users than the stereotypes suggest and these people just wouldn't accept it. At most they could go with an opt-out system. Otherwise I think app-stores are more of a positive evolution than people give them credit for, when they are not shoved down your throat that is. The signing of software to guarantee that it hasn't been modified or tampered with is a no-brainer, a bit like having shrink-wrap around a box-set of physical media.

It still requires the user to click through

[Shivetya]

You are still required to click through an install wizard, so this is in no shape or form an install performed without the user.

But, but...

[Moraelin]

But... but... weren't we all told that this isn't possible? I'm sure I've heard the rhetoric repeatedly before that if someone didn't bother porting some malware to Mac or Mozilla back when they had tiny market share, then it's some kind of proof that they're secure and it can't be done.

Re:Good

[_Sprocket_]

Hi profile attacks that occur in user space help to underscore that the obsession OS vendors have with admin access doesn't do much of anything to prevent a machine from being compromised -- it only serves to give users a false sense of security.

I have a hard time completely dismissing privilege escalation. There is still some value in being able to separate user data from the system proper - if only to make clean-up easier. But I do completely agree with the overall lesson here. An overly simplified view of security might very well overlook the fact that there's still a lot of value with operating in the context of an unprivileged user. And as such, users should remain wary whenever they're acting outside the boundaries of their local environment.

It strikes me that this is a subset of the dancing pigs problem. The promise is that computing is being made easy. And in doing so, the end user gets all manner of over-simplified, friendly (or frightening) messages wanting their rubber-stamp to do various unknown black-box things. Whether you promise dancing pigs or protection from evil hackers, it comes down to the same thing. Present the proper dialog box and end users are likely to accept it.

This is a problem that won't be solved by more dialog boxes. At some point, the user needs to be exposed to some level of the complexity of their environment and hopefully given enough information and skepticism to make reasonable decisions.

Re:More damaging for Apple than most think...

[Vokkyt]

The problem with this assessment is that it's the exact same assessment that OS X has been receiving for the past 6 years whenever a new Trojan pops up. And no, this trojan really isn't any different than its predecessors. I'm not trying to defend OS X as the almighty glorious Mac Master Race computer, but it's a little ridiculous to see this cycle every time an OS X Trojan pops up (and they've pretty much all been trojans -- IIRC, a few were classified as worms, but I really don't remember clearly):

1. Malware appears for OS X
2. AV companies advertise it wildly
3. Journalists/"Analysts" declare that age of Innocence for OS X is over, no longer "immune" to Malware
4. Message Board users declare the end of OS X/Catastrophic damage
5. Time passes and reality sets in -- the Malware/Trojan fails to reach any noticeable level of threat

Again, this isn't to say OS X is immune. Absolutely not. But every time a bit of Malware appears, this exact cycle happens -- and OS X and Apple's sales only go up.

So uh...

[bmo]

Where, exactly, is this going to hide from htop, top, ps or any other process listing facility?

Unlike Windows, OSX and Linux and every other sane OS in the universe, there is no such thing as a "hidden process."

As a user process, it also cannot patch top, ps, or htop, or any other process lister. It cannot fuck with logs. It cannot do anything at all that the ordinary user cannot do. Indeed it runs under the same UID as the logged in user.

ps -uax | grep $USER
OH HEY GUYS THAT LOOKS WEIRD
killall -9 $SUSPICIOUS PROGRAM
rm $PATHTOSUSPICIOUSPROGRAM/SUSPICIOUSPROGRAM

And not even have to have a # in your prompt. No sudo, no su, no nothing.

Go on with life

Wow. That's...difficult.

--
BMO

Re:So uh...

[robmv]

oops I forgot, when the malware is installed, it can just change all your init session scripts, prepend a directory to your PATH, install new versions of ps, top, htop, kill,.... not impossible to detect, but it can hide itself a little more that simple running ps and kill

Re:So uh...

[Arrepiadd]

Yes, I can clearly see my mom running that on her laptop...

This is a problem for the random user, not for the geeks who know what ps, grep and piping are used for.

Re:So uh...

[drinkypoo]

Unlike Windows, OSX and Linux and every other sane OS in the universe, there is no such thing as a "hidden process."

There are no hidden processes in Windows, only those which the task manager will not display. Get process explorer, it's free.

Re:So uh...

[benjymouse]

So here's the question:

Why won't task manager show hidden processes?

Why do I have to rely on a third party (Sysinternals) now bought by Microsoft, just so I have the ability to see these things?

What are you talking about? Task manager shows the same processes as process explorer. Did you miss the "show processes for all users" button?

Only your own folder? Still...

[lpp]

That seems like it's not really any protection at all. Most Macs are likely single user setups anyway. Sometimes, sure, you'll have some other users on the machine, but most of them are likely just tied to one user.

To that one user, their files are the critical component of the machine. If they bought the machine, they have the reinstall discs for the OS, plus those of any upgrades. Annoying? You betcha. But if they haven't been backing up their files (shame on them) then having to reinstall the OS is the LEAST of their worries.

And this of course goes for Windows and Linux installs as well. And really, even in a multi-user/single-machine scenario, while the damage is limited, it is still potentially devastating for the user involved. And again, for many (most?) installs, there's only one user that matters anyway.

Re:There's a difference...

[hairyfeet]

Oh you're so right, why they can even get to the DOS underpinnings that way! Oh, wait a tick, that hasn't been true for nearly FIVE years now since on Vista and 7 both run IE under low rights mode something even Linux doesn't have. Last time I checked Linux ran the browser with the same rights as the user that launched it whereas both IE and Chromium based (like the Comodo Dragon I'm typing on now) run as LOW rights, with the Dragon and other chromiums going one more step further and sandboxing (and if you are running the excellent Avast free you can have a "Yo Dawg" moment as it sandboxes too) the browser.

So unless you want us to start talking about how Linux is only up to version 2 of the kernel and doesn't support SATA yet you might want to stick with the facts, kay? If someone chooses to run a decade old OS, even if MSFT is nice enough to still offer security patches, that still isn't gonna make it safe for the modern web, anymore than digging out some 10 year old Debian discs would make for a very secure web server.

As for TFA, what was it I said to the Mac troll that swore up and down it wasn't a bug (he insisted on correcting everyone with a nice blame the victim "its a trojan!" meme) and insisted It didn't have anything to do with his excellent OS, just stupid users? oh yeah I said "the blood is in the water, now the wolves will come because they have seen that many Macs are like sheep ready for the slaughter" and guess what? I was right! Apple has gotten by with "security by obscurity" for so long that practically NO sally average Mac user follows safe practices, nobody on the Apple side runs AV or antimalware, so here come the sharks.

Which only makes sense, because despite all the "poo poo, Macs aren't toys for the rich, poo poo" studies have shown that not only do mac owners have multiple Macs, they on average pull down $100,000 a year. Wow. Who do you think has a juicier CC? The guy making $100k a year pisslefarting on his Mac? Or Becky the Wally world checkout girl who just got that $400 Dell out of lay-away? I know who I would be going after, and it sure wouldn't be Becky. Windows will be the target for botnets, and Macs will be the targets of those wanting them CC digits.

Mark my words: Now that they have seen how well they can spread the blood IS in the water, now the sharks will come. like any other predator the wolves looking to steal CCs, be it by ransomware or scareware or simply snatching the digits, they will look at Macs like a hungry wolf looks at a nice T-Bone steak. If it is any consolation Mac guys, I have a feeling Android may be the "mass market" product the bones the Linux guys, so at least you won't be alone. As a windows builder allow me to say...Welcome! The "how not to get pwned" workshop is on Thrusdays, coffee and donuts are in the back. Welcome to the club fellas, hey at least that means you're popular now, right?

Re:There's a difference...

[sqlrob]

There's a glaring flaw in your reasoning.

Malware authors don't want to wreck your system. They want to get value out of your system. That doesn't need root.

Even for enterprise users

[Sycraft-fu]

The "BUT IT DOESN'T INFECT THE SYSTEM!" screaming is just a geek defense mechanism that shows ignorance of how computers are actually used. Nobody at work gives a shit about the system. They don't care about the OS, the applications. They've learned that we, the IT people, can get that all back and running quickly. None of it matters to them.

What matters is their data. That is what they want, what they worry about. From the important, like actual work, to the trivial like bookmarks and backgrounds, that is what they want us to save when a computer has a problem. It is of no comfort to them that "The malware only infected your account," because their account is what matters to them.

Also in terms of real damage it also doesn't matter. Even if malware infects a system so bad there is no possible removal, who cares? I can rebuild a system from scratch no problem. However if malware gets in and steals passwords, credit card data, SSNs, then it doesn't matter if it just had access to one account, real damage is done.

Isolation to an account doesn't matter and the malware authors have figured this out.

Re:There's a difference...

[mrwolf007]

Oh, wait a tick, that hasn't been true for nearly FIVE years now since on Vista and 7 both run IE under low rights mode something even Linux doesn't have.

sudo -u $browseruser /usr/bin/firefox
Just create a seperate user for browsing if you dont want the browser messing around with your files. Sure, requires configuring sudoers, but not exactly rocket science.