| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Hacker flags ‘very severe hole’ in Vista UAC design | |
|
||
| Time: 10:49 EST/15:49 GMT | News Source: ZDNet | Posted By: Robert Stein | ||
|
Joanna Rutkowska has always been a big supporter of the Windows Vista security model. Until she stumbled upon a "very severe hole" in the design of UAC (User Account Control) and found out — from Microsoft officials — that the default no-admin setting isn't even a security mechanism anymore. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 320 Last | Next |
The time now is
7:17:08 AM
ET.
Any comment problems? E-mail us |
| #1 By 3653 (68.52.143.149) at 2/13/2007 11:55:47 AM |
|
calling this a 'very severe hole' is like me saying vista has a 'very severe hole' because it doesn't force all users to have alphanumeric and 1 special character in their passwords.
SURE, security would be MUKCH improved if that strict password format were enforced... but seriously... the cost to user friendliness would be far too high. |
| #2 By 61 (72.64.142.151) at 2/13/2007 11:56:10 AM |
|
Not all installer apps require admin rights (I've found a few, actually).
Beyond that, 90% (a number I pulled out of my rear, but sounds about right) of apps today are NOT written properly, that is, with a multi-user environmentment and standard user rights in mind, and as such these installers NEED to have admin privelages. You simply can not break 90% of all applications because the user is too stupid to make the distinction between a tetris installer and a malware installer. These installers need admin rights because they write to certain parts of the registry or into certain folders, none of which they should do to begin with, but Micrsoft can't stop bad developers from being bad developers, except to give the end user the option to allow or disallow the application. After a year or two newer applications will be comeing out with UAC in mind, and will be able to be installed by a standard user. Which would be especially nice because a lot of these apps that have per-user settings but otherwise require rights elevation will prompt you during install (or even when you run the app, sometimes) will store the stuff in your admin account instead of the user that actually installed it (Winamp is really bad with this). All in all, this self-proclaimed security guru is a complete dumbass. This post was edited by CPUGuy on Tuesday, February 13, 2007 at 11:56. |
| #3 By 55806 (65.111.175.127) at 2/13/2007 11:59:50 AM |
| You guys should read the articles before posting them on your web site. |
| #4 By 7754 (216.160.8.41) at 2/13/2007 3:45:10 PM |
|
CPUGuy--I think you're slightly off on the "written properly" issue. Standard users don't have write permissions to C:\Program Files and HKLM. From what you're saying, an application that is "written properly" should not write to those locations at all. That's not correct. Properly written applications can and should require admin rights to install. This is one of the best mechanisms IT has for maintaining consistent, predictable desktop images/installs.
I think you may be referring instead only to applications that write per-user data in HKLM or C:\Program Files. These applications are definitely NOT written properly, and should be ashamed of themselves. :) Regarding Rutkowska, she seems to have a bit of a chip on her shoulder, but nonetheless, she may have a point. They do not talk about the 64-bit case specifically, in which any kernel driver would require signing. At the same time, perhaps Microsoft can address this question. Better than simply criticizing it, though, she might offer some suggestions for a fix. More warning dialogs are not the answer (UAC prompt, then another UAC prompt: "Are you really sure you want to install this program? Joanna Rutkowska says there may be malicious code in it! You've been warned." Perhaps they can animate it in WPF...). |
| #5 By 254367 (125.164.237.42) at 12/3/2009 2:11:53 AM |
|
http://gadgetmu.net
http://videoplane.blogspot.com http://ncellphone.com http://yznews.co.cc http://ramadhan-blog.blogspot.com http://animewallpaperss.blogspot.com http://usnewss.blogspot.com |
|
Write Comment
Return to News |
Displaying 1 through 25 of 320 Last | Next |
The time now is
7:17:08 AM
ET.
Any comment problems? E-mail us |
