Bugtraq: Re: Tiny Personal Firewall

[elfs <elfs () rs gov lv>]

> It  must  be  the  responsibility of the OS to prevent console users
> interacting  with  applications  when the desktop is locked. No user
> process should ever be able to bypass the lock mechanism.
If we take a look to WinAPI help for, i.e. MessageBox, we see, that it
has a flag (WindowsNT only), called MB_SERVICE_NOTIFICATION:

(..)  The  caller  is  a  service  notifying the user of an event. The
function displays a message box on the current active desktop, even if
there is no user logged on to the computer (..)

So we can write a small test program:

---[ test.c ]---
#include <windows>
void main()
{
  Sleep(3000);                      // Pause, to give you time to lock
                                    // the computer
  MessageBox(
    NULL,                           // HWND, should be NULL
    "Who cares if we are locked?",  // Messagebox text
    "Test",                         // Messagebox caption
    MB_OK | MB_SERVICE_NOTIFICATION // Flags
  );
}

and   this gives a chance for almost any appl to communicate with user
on WinNT, even if the computer is locked.


Just my 0.02 Ls -

elfs,
  Latvia