Slashdot Mirror
LG Split Screen Software Compromises System Security
jones_supa writes: The Korean electronics company LG ships a split screen tool with their ultra wide displays. It allows users to slice the Windows desktop into multiple segments. However, installing the software seriously compromises security of the particular workstation. The developers required administrator access for the software, but apparently they hacked their way out. The installer silently disables User Account Control, and enables a policy to start all applications as Administrator. In the article there is also a video presentation of the setup procedure. It is safe to say that no one should be running this software in its current form.
Korean more likely. Software architectures of theirs I have seen are a mess of hacks and patches.
http://michaelsmith.id.au
Brian Fox wrote the GNU Bash shell. If you've ever used Linux or OSX, you've used his software.
I realize that the software probably shouldn't have disabled UAC out of the box without at least informing the user, but having worked on some out-of-process COM applications (yes, legacy) in Windows Vista/7/8/10, UAC can be extremely frustrating. The biggest issue is that having UAC on creates a different user context between user and admin. If I execute a program as myself with admin privileges, it is not exactly the same as executing the program as myself without admin privileges.
For example, if your user with admin priveleges creates a COM component, that component may not be able to be accessed by a non-admin context even though your user may be in the local administrators group, DCOM Users group, etc.
I wouldn't be surprised if LG ran into a COM issue with Windows and decided to make the program for reliable for the user by disabling UAC instead of resolving the problem in a different way.
But you still want to look like an asshole. Only egotistical narcissistic assholes use dual monitors.
I used to use a single monitor back when programs were written such that they didn't hog all available screen real estate while still somehow making it necessary for you to do 5 mouseclicks to get to any of the functions of the program. Back when 17" monitors were relatively new, I had a 17" monitor and I could have 3 or 4 terminal sessions going along with several Windows program and could work seemlessly. Now you are constantly paging because every single Windows program is unusable unless it is in full screen even though the number of white pixels is approximately 98%.
If you are not allowed to question your government then the government has answered your question.
The installer silently disables User Account Control, and enables a policy to start all applications as Administrator.
Holy fucking incompetence, Batman. This reminds me of Sony's rootkit, the one that tried to hide itself from AV software, but in doing so, opened up a huge hole that any malicious program could exploit. How does shit like this make it past any kind of review? What CIO/CTO says "hmm OK, gutting security on every customer's PC sounds like a great idea!" This approaches criminal levels of negligence.
Have you tried inverting the colours?
Get free satoshi (Bitcoin) and Dogecoins
Want a chocolate medal for the single monitor performance back in the good old days? Ever used punch cards as well? Or paper typewriter as a terminal?
Achille Talon
Hop!
It is a well-known fact that all Samsung software is utter crap. I have long suspected that this statement should admit a nice elegant generalization, and here it is.
Jokes aside, why third party software should ever be allowed to change UAC settings?
Yeah I used to have that problem with some Windows software, then I hacked the source code to run it headless and log important stuff to a terminal, so I didn't have to look at its silly graphical window. Oh right, you're using closed-source software, aren't you, asshole.
It is safe to say that no one should be running this software in its current form.
I'd say it's safe to say that the software shouldn't have done this without informing the user, but if someone wants to run it while knowing it is less secure than might otherwise reasonably be expected, who are you to tell them they shouldn't?
I disable selinux and in some cases I always log in as root, because I've decided that's the way I want to do things - I'd rather have the extra convenience than the extra security.
systemd is Roko's Basilisk.
I'm getting so fucking sick of this shit.
As what I'd consider a 'power user', one of the first things I do is turn that obnoxious thing off. I understand it's purpose for being there, it's to protect idiots. Though if you've been reading the studies related to 'security popups', they're pretty ineffective anyway.
A program that magically turns it off for you is definitely a bad thing. However, from a power user perspective, its like.. 'um i don't care, it was already off.'
Windows simply wasn't built from the ground up to insulate the user space from the root space, and frankly I don't know if it ever can properly do that. The fact some program that can change the UAC settings is pretty huge example of why Windows has issues separating userspace from root space. It just simply can't do it right. Who's brilliant idea at Microsoft was it to provide any sort of API that can let any program (besides the control panel widget that lets you adjust UAC settings) adjust UAC settings? Some majorly FUD there. I think this is more Windows' fault than this stupid dual monitor program. No program should be permitted, regardless of it's permissions, to touch things like UAC settings.
That attitude in people who don't know better is part of the problem.
Yes, you are a "power user", but so are the developers that wrote this stuff in their mind even if they did seriously fuck up. IMHO no developer should have seamless admin/root access on the machine they are testing their software out on and for new developers preferably not on their "daily driver" either.
Not that I wrote seamless and bolded it - they may need full admin/root access but they should know when they are a normal user and when they are not so that when the software is released it has been shown to run in an environment where it can be used as a normal user.
I've had this problem for YEARS where some people who still have the single user MSDOS mindset keep on writing software for internal company use that needs admin rights for utterly braindead reasons, simply because the developers were writing for their own "power user" environment and everyone else can go fuck themselves. One gem required admin access for the sole reason that it was putting a temporary file on the root of the "C" drive (it would also not work for people who had a different drive letter for their system drive). That was fixed, but of course the developer now thinks I'm an utter prick for insisting that his trivial VB app that should be replaced by a simple webpage has to be able to run as a normal user.
So while you may be fine, others that copy what you do without understanding the implications are not.
LG was the bottom end manufacturer GoldStar and they honestly have never changed their ways. LG smart TV's happily spy on you and they will not stop doing that, I have found several times that LG commercial sets will give you a ROOT login via the rs232 port if you reboot the set rapidly.
It is no surprise that LG decided to ship a half baked solution for their new flagship displays.
Do not look at laser with remaining good eye.
Fucking yellow goons, can't code for shit. Even worse than paki's.
P.S. Has anyone, anyever, where, met a nigger programmer?
How can it be that your body has not yet rebelled and simply refused to support the 10 pound tumor balanced on your neck?
Someone has to get fired for thinking that was a good idea.
Those who've actually done it know that it's actually more productive than multiple displays because of less eye panning. You can see more in less space. I had a high res 21" crt which, with the software back then, was far more productive for me than having two of today's 1080p monitors and the modern software UI designs he talks about.
OSS is following this trend too.. It's the trend that needs fixing. The software will follow. That will happen when today's 'ux designers' are banished to the hellpits they arose from.
You are full of shit my friend. I started my career on typewriter which were nothing less than computer screens on paper. I experienced the ascii terminals, the graphics terminals, the modern displays on CRT all sizes and flat displays and I am having two physical displays right now and I would take a third and a fourth without any problem and eye strain. Back in the old days, we were writing simple piece of software with simple interactions and well defined input/output access. The world has changed for the better, the proof being people are ready to pay good money for interactive and smart pieces of hardware and good software. I am very sorry for you, but personally I do not regret anything of the past. I'm old and I enjoy the wonderful gadgets we can imagine, build and have today, including multiple screen displays to work efficiently with many document and testing environments at once.
Achille Talon
Hop!
Sorry, but typewriters are ANYTHING but computer screens on paper.
With a typewriter, you're looking at the copy you're typing instead of what you're actually typing. If you're looking at what you're typing You Are Doing It Wrong.
The only thing they share is that, hey, QWERTY keyboard!
Chas - The one, the only.
THANK GOD!!!
Sounds like something a cool kid told you one day back in school, in front of pretty girls. I bet they laughed, and later that day gave him a blowjob duet while you were alone in your room playing with your Magic cards.
lucm, indeed.
As what I'd consider a 'power user', one of the first things I do is turn that obnoxious thing off.
I remember during the Vista Beta time frame visiting a website that I'd never been to before and all of a sudden having the browser cause a UAC prompt. Now you can go off on what sort of insecure hole could exist that would allow a website to make admin level privileges on a computer, but that doesn't matter; what matters is that fact that it could. I clicked 'No' on the prompt and felt a sudden rush of power over my computer that I hadn't had before. Previously random crap from anywhere could make admin level changes to my computer, and before UAC I'd have no\little idea about it. But with UAC I was in control now.
It happened a few more times too. I was doing something that shouldn't have required admin privileges, got a prompt and denied the poorly written program the access it was trying to usurp.
As a power user, I'm sure you're aware that it's a really bad idea to do your day to day computing logged in as a user with administrative permissions. So with UAC turned off you must have some system setup where you download your installers, and then switch users to the admin to actually install them. Sounds like too much work to me.
Turning off UAC is like have a setting that will click 'yes' to every prompt. An idiot would click 'yes' to every prompt. A power user knows when to click 'no'.
With a typewriter, you're looking at the copy you're typing instead of what you're actually typing. If you're looking at what you're typing You Are Doing It Wrong.
I have no idea what this means. I think you have inhaled (or ingested) too much correction fluid during your typewriter days. Also please stop saying "You Are Doing It Wrong" out of context, you are ruining a perfectly good catchphrase.
lucm, indeed.
Why don't you do like me, and put "sudo bash" in your .bashrc. A lot more efficient.
lucm, indeed.
No, I have seen some utterly substandard garbage code written by Ameriancs, so according to my anecdote it's probably from there.
CLI paste? paste.pr0.tips!
There are some situations where 2 monitors are necessary. I do a little video editing - 1 screen for the controls, and a second screen for the actual video. I can't afford a reference monitor, so I just use a good quality LED/LCD screen calibrated as best I can.
You can't edit video efficiently on a single screen, even a big one. There's just too much else on the screen to allow a decent sized window for the actual footage.
They sentenced me to twenty years of boredom
it's like you're a fuckwit linux zealot from 2005, somehow teleported to present day.
There are ways to work around UAC without disabling it in this case. I know, because I wrote MaxTo, which does much the same things, and works with software running under UAC.
If you want MaxTo to work with UAC, you'll need to run MaxTo elevated. If you say deny elevation, it simply won't work with elevated software.
I'm pretty sure LG just took the "easy way" out (or they may have nefarious purposes, but I won't speculate), instead of figuring out how to communicate between elevated and non-elevated processes.
To do this sort of thing, you'll need to divide your software into a few parts. First and foremost, you'll need to install a global system hook. That hook has to be written in unmanaged code (meaning C/C++). You'll need software that controls the hook (but it can be written in a managed language). Now, both the controlling software and the hook has to be compiled as both x64 and x86 code. They will probably also have to communicate with eachother across the x86/x64 platform boundary.
Now, to get the software to communicate (using window messages) across the UAC boundary, you have to specifically let Windows know which window messages your app will accept from the other side. This is probably the step they missed. You do this by using ChangeWindowMessageFilter or ChangeWindowMessageFilterEx .
If you're using a typewriter, you're looking directly at the content you're supposed to be typing. You're not looking at the pieces of paper on the roller that you're actually typing.
Chas - The one, the only.
THANK GOD!!!
.... this would be next to impossible without hacking the kernel itself. I'm sure there's a way to make every program start with setuid root in unix/linux but short of hacking init or the kernel filesystem code I can't think of one.
But then with Windows process privilidge levels always were a bolted on after thought so no surprises really.
Yeah mod me down, you know its true.
what is this "Windows" thing, anyway? Is that something like Wayland? Or rhather like ncurses?
You mean all people are (should be) like you AND no modern software is just a sad waste of money and time? I may consider the old ways of CRT and early windoze systems over glorified the way they were presented here but it is still trough modern software production has lowered bar for crapware. Still I consider your statement a typical murcan way of looking at things - me god of universe, you jane
Windows is poorly designed, and to do anything you need to hack the whole system.
And after you get around all the stupid designs and quirks used by windows to actually achieve what you need, you end up with Picasso-style operating system that barely works anymore and has no security at all (not that it had much of it before).
Windows design enforces using all the security holes to get around limitations that prevent you from implementing your functionality. So you end up exposing these holes and security issues to the world.
It's not a bug, it's the design. No freedom for you, no API to let you in securely, no layers of abstraction, one blob to rule them all... And you with your task to be completed in such environment.
Really, what would you expect from this piece of crap from microsoft?
In Linux you can do anything, you can even redesign parts you want to use to work in a way you need them to.
Achieving this multi-screen functionality in Linux would be a piece of cake, even under the old X11 system.
There are no nigger programmers.
If a black person is a programmer, than they are most likely educated and decent human.
Nigger is a state of the mind.
Unfortunately 90% of black people have it (and 10%-20% of white people as well).
Hence the stereotypes for black and white people (which are not racist, they are just statistics).
Surely its a bug/bad design that it's possible to silently disable User Account Control, and enable a policy to start all applications as Administrator. If you can do this without acknowledging a UAC popup then it makes UAC itself pretty useless
We already know all know about Microsoft Windows but what about this LG thingy?
The system I had to deal with: the intranet installed an activex component onto each workstation. The component checked to see if a USB device was mounted and if it was, it refused to connect to the internet. You had to disconnect the USB device, download your file, then reconnect it and copy the file. This was their idea of "security".
http://michaelsmith.id.au
Uh, no offense, but you don't know much about Linux, I take it?
There's a bunch of options, ranging from "mark everything setuid and owned by root" (the least efficient, but you could do it in a few lines of shell script) to simply making each user be UID 0 (which is a trivial edit to /etc/users).
Frankly, you kin of sound like you're mouthing off without knowing anything of what you're talking about (Windows or Linux. Windows NT (which everything since XP has been, in kernel and core components) was very much designed from the beginning with security options in mind. The fact that everybody then ran as Admin instead of running as a normal user unless a program needed admin is unfortunate, and is partially Microsoft's fault, but only somebody utterly ignorant would think that Windows security is an afterthought.
To be the kind of person who would be utterly ignorant and then open your damn fool mouth is... well, I'm sorry. Nobody wants to be that person. You do deserve to be modded down, but what you say is not true at all. I have mod points, as it happens, but chose to reply instead. Maybe somebody else will take care of you and your unfortunate attitude...
For what it's worth, here's some more info: It's true that mandatory integrity control (MIC), which has security impacts, is relatively new (Vista) to Windows, but at least Windows uses it at least slightly; a typical Linux distro doesn't use it at all (though it is available). Speaking of afterthoughts, though, Windows (NT family) has supported ACLs since its initial release, while Linux only supported basic Unix permissions (which are a small subset of the control that ACLs give you unless your group count balloons absurdly) until 2002.
There's no place I could be, since I've found Serenity...
Wow, I've rarely seen so much idiocy written in one post! I honestly can't tell if you're trolling just a little too subtly, or are sincerely that clueless. People are modding you up though, which is really unfortunate. Here, let me see if I can correct even a little of that...
If you run as a full Admin, nobody cares what you consider yourself; people who know anything about security (on *any* OS) are going to consider you an idiot. The fact that you think you know anything is just extra pathetic. People who actually understand security turn UAC up (to make it require your password, like the equivalent mechanism does on non-Windows OSes), or don't run as a member of Administrators at all (in which case UAC requires an Admin's password).
Welcome to... 1993? Windows NT was very much built from the ground up to do (among other things) exactly that. It was a core design goal and generally successful; while local EoP exploits have been found (and fixed) much like they are on every multi-user OS, I challenge you to get from my normal account to Admin on either my work or personal boxes. Fortunately, on a properly-used machine - even one being used by a security engineer, which I am - UAC prompts are very rare.
You're aware that the installer for this thing runs as Administrator (like most installers), right? How exactly do you propose separating Admin (the installer) from Admin (the privileges needed to change the way UAC works), and what the fuck does that have to do with separating user from Admin? Oh, by the way, "userspace" or "user mode" is the opposite of "kernel mode" or "supervisor mode". Everything in kernel runs as root, but not everything in root is in the kernel. Most processes running under root (or Administrator, or even SYSTEM) are user mode.
Do you have any fucking clue how an operating system works? I mean, even at the basic, general level? Here's a hint: when that Control Panel widget adjusts UAC settings, it is flipping some bits in some configuration store somewhere (*nix mostly uses text files for these stores, Windows mostly uses the registry; in this case the relevant bits are, indeed, in the registry). *ANYTHING* with arbitrary privileges on the system (like an installer running as root) can flip those bits; that's just a basic function of the way OS security works.
No, you actually don't. It's really kind of pathetic.
And how, exactly, do you propose to stop a program that has (worst case) the required permissions to load a driver that can touch physical memory directly from doing anything at all, including changing an OS setting? I sincerely ask you, please, tell me your brilliant idea for revolutionizing the entire field of computer security more than anything since Multics development started 50 years ago.
There's no place I could be, since I've found Serenity...
You're aware that Windows 1-3.x, Windows 9x, and Windows NT/2000/XP/Vista/7/8.x/10 are each very different systems, right? No, of course you're not, you're a loudmouth who has no idea what he's talking about. Windows NT (which is to say, every version of Windows for PCs or servers since XP) was very much designed with isolation between *all* users, including between Administrators and non-Administrators, as a central feature. Windows NT is not, and never has been, a single-user operating system.
The last version of Windows that was designed as "A SINGLE USER operating system" was Windows ME. Why the fuck would you want to run as though you're running Windows ME? That's bloody idiotic!
Windows NT 3.1 (the initial release, came out in 1993) was very much multi-user, although it wasn't terribly good at timesharing (it wasn't until Windows 2000 that Microsoft added the ability for multiple interactive logins at the same time).
As for why you shouldn't use your OS as a single-user system, there's a number of reasons. One of them is because you, personally, obviously aren't competent to use a computer securely, and probably shouldn't be trusted with anything you have more control over than an iPad (which is, by the way, very multi-user although the earliest versions of iPhone OS, before it could run third-party apps at all, ran everything as root). Another is because sometimes other people run stuff on your computer (via exploits or Trojans or just by walking up to it while you're taking a piss) and you probably don't want them to be able to change everything they feel like changing (you had an impressively stupid rant above about how even an installer shouldn't be able to change UAC settings, which was funny).
There's no place I could be, since I've found Serenity...
This sounds a little like Windows firewall (on our company's installation of Windows 7). It's not enough to stop Windows Firewall in "Administrative Tools\Services", one must disable it from starting (set "Startup Type=disabled"), and then reboot the PC. Just stopping Windows Firewall after it has started does not produce the same behavior as not starting it.
Apparently their dual package does the same thing:
http://www.lg.com/ae/microsite/lg-monitor-apps/Dual_Package/section_3.html
archived here in case they change it:
http://web.archive.org/web/20150412154851/http://www.lg.com/ae/microsite/lg-monitor-apps/Dual_Package/section_3.html
e.g.: every piece of software, samsung ever published
"written by Ameriancs"
Who the hell are ameriancs?
gp obviously meant to say "Ameri-yanks"
Several years ago, I was working on a guy's Windows Vista system. He was unable to use the Verizon software to connect to the Internet through his Verizon wifi hotspot. In Vista, you could disable UAC for the whole system, but not just for one specific application. I knew that disabling UAC completely was not a good thing to do. So I spent hours and hours on this problem, not charging him per hour but instead a ridiculously low fee for the whole job. I was getting close to making it work, but I needed to come back. After I left, the guy called up Verizon technical support. They told him to just disable UAC for the whole system!
It sucked because I knew I was trying to do the right thing for him, but then Verizon came along and did the easy but wrong thing. The guy never called me back.
Liberal witch hunters are hilarious. They remind me of those pro-life people who bomb abortion clinics.
lucm, indeed.
Not a big deal. I've used the built in Administrator account as my primary account for all my Windows systems, always. Hated when MS started using "User" accounts as the primary account starting with Windows Vista. It's not like all the malware and crapware out there doesn't give itself administrator access to your system anyway. What's the point of being a User on your own system when malware has administrator access?
"Net user administrator /active:yes"
Use that as soon as you install a Vista or above windows OS, log into the admin account, and start enjoying a UAC free OS experience! Then if you ever download crapware, no more "you need administrative access to remove this program" when trying to remove it :-)
I HATE OS's that use "accounts" so much hassle and hurts system security so much. I miss you Mac OS Classic :-(