Slashdot Mirror
LG Split Screen Software Compromises System Security
jones_supa writes: The Korean electronics company LG ships a split screen tool with their ultra wide displays. It allows users to slice the Windows desktop into multiple segments. However, installing the software seriously compromises security of the particular workstation. The developers required administrator access for the software, but apparently they hacked their way out. The installer silently disables User Account Control, and enables a policy to start all applications as Administrator. In the article there is also a video presentation of the setup procedure. It is safe to say that no one should be running this software in its current form.
Brian Fox wrote the GNU Bash shell. If you've ever used Linux or OSX, you've used his software.
The installer silently disables User Account Control, and enables a policy to start all applications as Administrator.
Holy fucking incompetence, Batman. This reminds me of Sony's rootkit, the one that tried to hide itself from AV software, but in doing so, opened up a huge hole that any malicious program could exploit. How does shit like this make it past any kind of review? What CIO/CTO says "hmm OK, gutting security on every customer's PC sounds like a great idea!" This approaches criminal levels of negligence.
since most Windows programs are written incorrectly
What a load of garbage. I rarely if ever see UAC prompts other than installing software. This goes for programming tools both well written and poorly hacked together, all manner of internet related things (reads browsers, Acrobat, flash, etc) remote administration tools, games, office productivity applications, even my explorer replacement program doesn't bug me with a UAC prompt.
In fact the only program I've ever used that needed UAC prompts was a custom VPN tool, and it only needed UAC because it had the ability to tie into windows settings and modify the system's own L2TP VPNs on top of providing an OpenVPN client, something that requires elevated privileges to do.
What you're saying I haven't experienced since maybe 2-3 months after Vista was released. So please share some more details on what exactly you are doing that makes a UAC prompt appear every time you move the mouse, and which of the many millions of programs on the PC actually require administrator to run?
If you need to use COM components, and you don't want to require admin rights, you register them in HKEY_CURRENT_USER instead of HKEY_CLASSES_ROOT. After that, it just works.
The sad part is, it would have not have taken any more time to Google that than to find how to disable UAC through the installer.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
Yes, a component in an admin context may not be accessible to a component used by user in a non-admin context. This is called a "security" model, and prevents the non - admin process manipulating the admin-context process to do things it shouldn't be able to do. You make it sound like a quirk, but the entire design is that "non elevated components can't talk to elevated components". Try starting Notepad as admin and dropping a text file on it from the non - elevated explorer view, it won't work by design.
It is a well-known fact that all Samsung software is utter crap.
We're bashing LG here, not Samsung. It's their turn next week, after we do Microsoft on Monday.
As others have said...the "problem" you're describing is *exactly the farking point of UAC* - it's *intentional*. of course the context is different - that is almost completely the entire design concept of UAC, and as an infosec and 20+ year UNIX guy, I personally appreciate UAC in windows when I'm forced to use that OS (which is all too often). UAC isn't a bad thing, it's a *good* thing. And if you can't get your program to work with UAC, either you're bad at design, or your program shouldn't exist.
The fact some program that can change the UAC settings is pretty huge example of why Windows has issues separating userspace from root space. It just simply can't do it right. Who's brilliant idea at Microsoft was it to provide any sort of API that can let any program (besides the control panel widget that lets you adjust UAC settings) adjust UAC settings?
I hope you realize what you are saying here is the equivalent of a Linux user saying "The fact that some program can change permissions after I launched it as root is an example of a huge security hole. Whose brilliant idea was it to provide any sort of mechanism that can let any program I run as root do things a user who is root can do?".
This is an example of why UAC exists, in fact: A program that is not UAC elevated could not change your UAC settings (if you hadn't turned them off already).
No, I have seen some utterly substandard garbage code written by Ameriancs, so according to my anecdote it's probably from there.
CLI paste? paste.pr0.tips!
Oh dear, you got modded up, what a surprise.
"There's a bunch of options, ranging from "mark everything setuid and owned by root" (the least efficient, but you could do it in a few lines of shell script)"
Yes, and it would take literally hours on a bit system plus a lot of things would break because they check their user id and won't run if they have superuser permissions for security reasons. As for NFS mounts... Next...
"which is a trivial edit to /etc/users)."
$ ls -l /etc/users /etc/users: No such file or directory
ls: cannot access
Oh 'm sorry, did you mean /etc/passwd ?
Yes you could set all users to uid 0. And nothing would happen except no one would be able to login since in unix users are actually distinguised by their numeric user id, not their name which is merely an attribute thats used for login.
"Frankly, you kin of sound like you're mouthing off without knowing anything of what you're talking about"
Ah, theres nothing like a nice bit of irony in a post :o)
" have mod points, as it happens, but chose to reply instead"
You shouldn't have bothered. You might know ignorance about unix is quite apparent since you don't even realise why ACLs are required in Windows but rarely used in unix due to group permissions and multiple group membership.
Now go away and educate yourself.