Vista's Security Rendered Completely Useless By New Exploit
Linked by Amjith Ramanujam on Fri 8th Aug 2008 13:14 UTC
Windows This week at the Black Hat Security Conference two security researchers will discuss their findings which could completely bring Windows Vista to its knees. According to Dino Dai Zovi, a popular security researcher, "the genius of this is that it's completely reusable. They have attacks that let them load chosen content to a chosen location with chosen permissions. That's completely game over."
E-mail Print r 12   79 Comment(s) http://osne.ws/fk7
Thread beginning with comment 326242
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Bottom Line
by JoeBuck on Fri 8th Aug 2008 17:56 UTC in reply to "RE: Bottom Line"
JoeBuck
Member since:
2006-01-11

Users aren't just running as administrator out of habit; many programs just won't run correctly otherwise.

We usually run Linux on occasion, but once in a rare while I'll boot up Windows to do something or other. For example, my daughter was given a game for her birthday, so I booted up Windows to try it out. Turns out that I had to make my six-year-old girl an administrator if she wanted to play the game!

So while the architects did a good job on the core system, common practices force users to turn off the security.

Reply Parent Score: 2

RE[3]: Bottom Line
by JamesTRexx on Fri 8th Aug 2008 18:07 in reply to "RE[2]: Bottom Line"
JamesTRexx Member since:
2005-11-06

A nice workaround to giving someone admin rights just to run a game is using Sandboxie (http://sandboxie.com) to sandbox the game.
I recently used this to run Return to castle Wolfenstein with a regular user account as it wanted to change some files for which admin rights were needed.
Get a registered version and you can sandbox each program seperately and an added bonus might be that each player has their own savegames.

Reply Parent Score: 3

RE[3]: Bottom Line
by apoclypse on Fri 8th Aug 2008 19:28 in reply to "RE[2]: Bottom Line"
apoclypse Member since:
2007-02-17

Users aren't just running as administrator out of habit; many programs just won't run correctly otherwise.

We usually run Linux on occasion, but once in a rare while I'll boot up Windows to do something or other. For example, my daughter was given a game for her birthday, so I booted up Windows to try it out. Turns out that I had to make my six-year-old girl an administrator if she wanted to play the game!

So while the architects did a good job on the core system, common practices force users to turn off the security.



Well installing anything, even a game should require an admin account. There are dll files that get installed sometimes and sometimes changes to the registry. The same applies to most Linux and OSX apps. The issue I see with windows is when Ix install an app and log in as a non-admin user and get all these errors when I log in about not having permission to run my apps because they need admin rights. There shouldn't be any apps requiring admin rights unless they are making system wide changes.

Reply Parent Score: 4

RE[4]: Bottom Line
by ari-free on Fri 8th Aug 2008 20:36 in reply to "RE[3]: Bottom Line"
ari-free Member since:
2007-01-22

people are always installing and trying out new software. They won't like to switch in and out of admin, even if everything works in limited user mode. So take the sudo approach and enter your password every time you want to change the system.

Reply Parent Score: 3