Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Question for the Windows pros
From: Frank Knobbe <frank () knobbe us>
Date: Wed, 18 Jan 2006 17:07:23 -0600

On Wed, 2006-01-18 at 16:16 -0600, Paul Schmehl wrote:
This means that the exposure, when granting the privilege, is as follows:
1) If you can launch a process on the local machine AND
2) The process has embedded credentials that are different from the user 
launching the process THEN
3) The user gains those credentials' privileges ***for the length of that 

Yup. So if your use has that right, any spyware the user downloads via
IE can use that user right to elevate credentials **for the length of
the malware installation**. Does that sound right? And does that sound
like something you'd want to happen?

You're caught between a rock and hard spot. You need to install
software, but don't want to give admin rights. So you have to meddle
with user rights in order to install the software, which would leave the
user again vulnerable to "other software" taking advantage of that user

If you give that right, or admin privs, why don't you limit that only to
the duration of the software install? It sounded like you were planning
on granting that user right and leaving it in place. If you only grant
it temporarily, the exposure is not great, imho. (Remember, I've been
liberated from Windows for a couple years now ;)

So, why did M$ decide to remove this right from the user?  Because it 
prevents them from installing software on the box.

Right. But now you find yourself having to dish out that right again to
make some software work. What's wrong with that picture? ;)


It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Attachment: signature.asc
Description: This is a digitally signed message part

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]