Linked by Amjith Ramanujam on Fri 8th Aug 2008 13:14 UTC
This week at the Black Hat Security Conference two security researchers will discuss their findings which could completely bring Windows Vista to its knees. According to Dino Dai Zovi, a popular security researcher, "the genius of this is that it's completely reusable. They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over."
Thread beginning with comment 326230
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:2006-01-11
Users aren't just running as administrator out of habit; many programs just won't run correctly otherwise.
We usually run Linux on occasion, but once in a rare while I'll boot up Windows to do something or other. For example, my daughter was given a game for her birthday, so I booted up Windows to try it out. Turns out that I had to make my six-year-old girl an administrator if she wanted to play the game!
So while the architects did a good job on the core system, common practices force users to turn off the security.
Member since:2005-11-06
A nice workaround to giving someone admin rights just to run a game is using Sandboxie (http://sandboxie.com) to sandbox the game.
I recently used this to run Return to castle Wolfenstein with a regular user account as it wanted to change some files for which admin rights were needed.
Get a registered version and you can sandbox each program seperately and an added bonus might be that each player has their own savegames.
Member since:2007-02-17
Users aren't just running as administrator out of habit; many programs just won't run correctly otherwise.
We usually run Linux on occasion, but once in a rare while I'll boot up Windows to do something or other. For example, my daughter was given a game for her birthday, so I booted up Windows to try it out. Turns out that I had to make my six-year-old girl an administrator if she wanted to play the game!
So while the architects did a good job on the core system, common practices force users to turn off the security.
We usually run Linux on occasion, but once in a rare while I'll boot up Windows to do something or other. For example, my daughter was given a game for her birthday, so I booted up Windows to try it out. Turns out that I had to make my six-year-old girl an administrator if she wanted to play the game!
So while the architects did a good job on the core system, common practices force users to turn off the security.
Well installing anything, even a game should require an admin account. There are dll files that get installed sometimes and sometimes changes to the registry. The same applies to most Linux and OSX apps. The issue I see with windows is when Ix install an app and log in as a non-admin user and get all these errors when I log in about not having permission to run my apps because they need admin rights. There shouldn't be any apps requiring admin rights unless they are making system wide changes.
Member since:2005-11-06
And security is also very tight because the user can only write to their home directory.
Unfortunately not quite true...
Windows has permissions on several directories including the root of the disk that allow anyone to create files and folders, these are done with the so-called owner account.
I have to remove these permissions on terminal servers because they still allow users to install programs that don't use the Windows installers.
Only after this is done can users forget about writing anywhere but their own profile directory.
Member since:2005-07-06
Windows has permissions on several directories including the root of the disk that allow anyone to create files and folders, these are done with the so-called owner account.
please check it again
on my pc (no permissions changed) root is only writeable by the administrator and the system itself. normal users can only read from it, and guests can't even see it's content.
Member since:2006-10-10
Member since:2005-06-29
Exactly how is Windows (or NT) considered multi-user when all it takes is Power User permissions (maybe less) to be able to access anyone else's home folder on the PC?
Because that's how the permissions and ACLs in Windows are set up by default.
Look, just because German car manufacturers have a gentlemen's agreement to limit their cars at 250kph doesn't mean German cars can't go faster than 250kph.
The comments to this story make it abundantly clear - once again - just how much Microsoft has completely squandered the NT design, completely ignoring all the potential it had. My god Dave Cutler must be SO pissed off about all this.
Member since:2005-11-10
Exactly how is Windows (or NT) considered multi-user when all it takes is Power User permissions (maybe less) to be able to access anyone else's home folder on the PC?
ACL's in Windows are powerful but complicated and also not used often or proper.
Linux permissions are pretty straight forward and easy to use. Maybe not as encompassing as in Windows but pretty easy to figure out and use.
News
Linked by Thom Holwerda on 05/19/13 23:15 UTC
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
Linked by Thom Holwerda on 05/19/13 23:11 UTC, submitted by Drumhellar
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
Linked by Thom Holwerda on 05/18/13 21:06 UTC
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
Linked by Thom Holwerda on 05/18/13 7:37 UTC
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Linked by fran on 05/18/13 1:38 UTC
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Linked by Thom Holwerda on 05/17/13 23:35 UTC, submitted by kragil
Ars nails it: "The answer is that Google did announce what amounts to a fairly substantial Android update yesterday. They simply did it without adding to the update fragmentation problems that continue to plague the platform. By focusing on these changes and not the apparently-waiting-in-the-wings update to the core software, Google is showing us one of the ways in which it's trying to fix the update problem."
Linked by MOS6510 on 05/17/13 22:22 UTC
"It is good for programmers to understand what goes on inside a processor. The CPU is at the heart of our career. What goes on inside the CPU? How long does it take for one instruction to run? What does it mean when a new CPU has a 12-stage pipeline, or 18-stage pipeline, or even a 'deep' 31-stage pipeline? Programs generally treat the CPU as a black box. Instructions go into the box in order, instructions come out of the box in order, and some processing magic happens inside. As a programmer, it is useful to learn what happens inside the box. This is especially true if you will be working on tasks like program optimization. If you don't know what is going on inside the CPU, how can you optimize for it? This article is about what goes on inside the x86 processor's deep pipeline."
Linked by Thom Holwerda on 05/17/13 22:15 UTC, submitted by Tom
"It was the only moment I heard regret slip into Otellini's voice during the several hours of conversations I had with him. 'The lesson I took away from that was, while we like to speak with data around here, so many times in my career I've ended up making decisions with my gut, and I should have followed my gut,' he said. 'My gut told me to say yes.'" The world would've been a much different place - Apple would have been less dependant on Samsung for its chips, which probably would've meant less money for Samsung to develop its Galaxy business.
Linked by Thom Holwerda on 05/16/13 21:41 UTC
Glass is getting some love at Google I/O as well. New applications have been released - Facebook, Twitter, Evernote, Elle, Tumblr, and CNN. Perhaps more interesting: the newly announced Google Glass Developer Kit will allow offline applications and direct hardware access - great for hacking and expanding Glass' potential. This kit will really allow hackers to put Glass through its paces.
Linked by Thom Holwerda on 05/16/13 17:04 UTC
"But Beck and Merrill decided that simply banning toxic players wasn't an acceptable solution for their game. Riot Games began experimenting with more constructive modes of player management through a formal player behavior initiative that actually conducts controlled experiments on its player base to see what helps reduce bad behavior. The results of that initiative have been shared at a lecture at the Massachusetts Institute of Technology and on panels at the Penny Arcade Expo East and the Game Developers Conference." Absolutely fascinating stuff. I'm a League of Legends player, and to be honest, the community isn't nearly as bad as some make it out to be. I'm happy Riot games has the guts to employ science to address the issue.More News »
Sponsored Links
Member since:
2007-09-17
Your post is very inaccurate. Windows (NT based versions) are inherently multi-user. Each user has their own home directory in windows as well. And security is also very tight because the user can only write to their home directory.
The problem is that most people are habitual of running windows as Administrator. This was the decision made by Microsoft to make Administrator as the default users for people migrating from Windows 9x.
These problems are due to business decisions as Microsoft doesn't want to alienate users by forcing them to run as limited user which would mean educating users on the difference between normal user account and administrator etc etc.
It is a tough problem to solve. You either bite the bullet and let users complain or you do something like UAC and still users complain or you do nothing and then users complain about security (or lack of it).