×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Vista Hacking Challenge Answered

ScuttleMonkey posted more than 7 years ago | from the still-some-work-to-be-done dept.

388

debiansid writes "Microsoft's most secure Operating System yet has been compromised at the Black Hat hacker conference. We all know that Andrew Cushman, Microsoft's director of security outreach invited the Black Hats over to touch and feel Vista in order to showcase the superiority of this OS. Joanna Rutkowska, from Coseinc, a Singapore-based security firm, obliged and showed how it is possible to bypass security measures in Vista that prevents unsigned code from running with the help of a little software she calls the 'Blue Pill.'" To be fair, the hack was possible only when the target is in administrator mode rather than a limited user account.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

388 comments

Would they tell anyway? (4, Interesting)

Alcimedes (398213) | more than 7 years ago | (#15862422)

So if you're a black hat and you've found a new, as yet undiscovered hole in Vista, would you really go running to MS to tell them all about it so they can patch it?

Or would you keep it to yourself in hopes that the final release will still contain the hole so you can pwn millions of new adoptors?

Re:Would they tell anyway? (5, Interesting)

twofidyKidd (615722) | more than 7 years ago | (#15862449)

More interestingly, will MS actually patch it, even with complete knowledge of the hole? If it further delays Vista's release (because of potentially complex code organization, or other roadblock), they might not even bother until later.

Re:Would they tell anyway? (5, Insightful)

rifftide (679288) | more than 7 years ago | (#15862761)

Now this is really cynical - but they may have planned it this way. It looks like Vista may blow by even the latest (January 2007) deadline to resolve a raft of useability bugs, and this gives them the perfect cover to extend the ship date without looking totally inept. "We were ready to RTM at the end of 2006 but some late-breaking vulnerabilities were discovered, and we decided we couldn't take chances with the security of our customers' systems."

This is not just a matter of losing face. If the Windows team blows the revised date by several months (say April or later) AND it ships what is considered to be a lackluster product, many people will start considering the Windows codebase as a sustaining mode project. They will assume that Microsoft is busy preparing a brand new code base (based on FreeBSD plus .NET and DirectX, let's say) to debut five years from now, and will work out a transition plan for Win32 apps. Windows will be a lame duck in the minds of both customers and MS engineers. Alternatives will be sought.

Re:Would they tell anyway? (4, Funny)

pedantic bore (740196) | more than 7 years ago | (#15862450)

I'd try to trick them in to rewriting some crucial piece of the security infrastructure at the last possible minute. That way, I'd never run out of new holes to fine.

Perhaps I'd do this by smiling and saying that the OS was so secure that I couldn't find anything wrong with it and recommending, no, begging that they ship it in exactly its current form.

Re:Would they tell anyway? (2, Insightful)

xilmaril (573709) | more than 7 years ago | (#15862453)

If you're a truely vile blackhat, you'd probably go for choice #2.

Most of these people at the blackhat con aren't of ill intent, though. They're just hackers who won't let microsofts convenience get in the way of their fun.

Besides, with Microsofts history, I'd say it's pretty unlikely this hole will be patched if vista comes out before 2008. They certainly didn't patch any other verison of windows with that kind of speed.

Would they tell anyway?-Blabbermouths. (0)

Anonymous Coward | more than 7 years ago | (#15862621)

Whew! Good thing I got here before you got moderated insightful. Substitute Linux for Vista and ask your question again.

Only works as an administrator but... (5, Insightful)

mcguiver (898268) | more than 7 years ago | (#15862423)

show me the average home user who doesn't runs XP as administrator. Do they think that anything is going to change for Vista?

Re:Only works as an administrator but... (4, Funny)

twofidyKidd (615722) | more than 7 years ago | (#15862440)

I posted a similar comment mere seconds after yours. Bet I win with the most "redundant" down mods.

Re:Only works as an administrator but... (4, Informative)

DrDitto (962751) | more than 7 years ago | (#15862442)

show me the average home user who doesn't runs XP as administrator. Do they think that anything is going to change for Vista?

Yes, it is going to change for Vista. The default user will not have admin privileges.

Re:Only works as an administrator but... (2, Insightful)

EmbeddedJanitor (597831) | more than 7 years ago | (#15862458)

But they'll change that as soon as they need to install some drivers etc.

Shut the fuck up, Donny (3, Funny)

heinousjay (683506) | more than 7 years ago | (#15862511)

Vista's security scheme works like sudo or the OS X admin password dialog. You're out of your element.

MS Support calls (0)

Anonymous Coward | more than 7 years ago | (#15862572)

Vista's security scheme works like sudo or the OS X admin password dialog.

In what way?

If I click on "Install" or just insert my installatoin CD, and Vista says, "Login as Admin, owner, or someone with security privileges.", will it know to just install the software based on ...ESP? How will it know that the user is the admin or owner? Do you really think that the average user will know what that means?

My wife, as smart as she is (medical - lucky me!), will get those dialog boxes from windows when she wants to install software. She'll run to me ans ask what to do.

MS is going to get a shit load of tech support calls over this!

Re:MS Support calls (5, Informative)

SEMW (967629) | more than 7 years ago | (#15862606)

By default, the true administrator account is hidden and disabled by default. Most people won't even know it's there, and you have to go through a rigmarole to enable it if you really want it (these a how-to guide at http://www.computerworld.com/action/article.do?com [computerworld.com] [computerworld.com] mand=viewArticleBasic&articleId=9001970). The "administrator" account that Vista creates by default is actually a standard user that can temporarily elevate to admin privelages on a task-by-task basis. It pops up a dialogue box like http://www.winsupersite.com/images/showcase/winvis ta_ff_uac_13.jpg [winsupersite.com], letting you press a big button that says 'allow' if you know it's something you initiated (e.g. you're trying to install something). You don't need to logout and relogin.

Re:MS Support calls (5, Informative)

ChronoReverse (858838) | more than 7 years ago | (#15862616)

This is the way it works:

You can either be a limited user or an "administrator". By default in the current beta you're an "administrator".

What this means is that everytime an action is undertaken that actually requires administrative rights, Vista will pop up a dialogue (a la security warnings in Internet Explorer) and make sure you really wanted to do that. If you think this would be annoying (and would just train users to click yes) let me tell you that it was actually worse in Beta1.

There it popped up ALL the time and even if a background task does something that requires it, the entire system would stop and pop up the dialogue. At least now it'll just block and wait for you to notice the new task button and deal with it.

If you're on a limited account, you'll have to run whatever it was you were trying to run with the context menu "Run as admin" item. Then you'll have to type the admin password. Then when the program does something that actually requires the rights, it may or may not pop up the UAC dialogue.


At least MS is putting hoops for us to jump through.

Re:MS Support calls (1)

Tim C (15259) | more than 7 years ago | (#15862731)

Ever since Win2k, the response to that message was to right-click the installer, choose "Run As..." and enter the credentials of an administrative account.

If you can deal with using sudo on a Linux box, you can deal with runas under Windows.

Re:MS Support calls (1)

oc255 (218044) | more than 7 years ago | (#15862796)

But there's problems with that. Because my IE shortcut as a normal user doesn't use Run->Run As.

Re:Only works as an administrator but... (0)

Anonymous Coward | more than 7 years ago | (#15862525)

Hey I have an idea! Why don't you actually learn something about Vista (or maybe even try running it yourself) before you comment? Your post just proves you have no idea what you're talking about.

Re:Only works as an administrator but... (4, Insightful)

Reverend528 (585549) | more than 7 years ago | (#15862527)

But they'll change that as soon as they need to install some drivers etc.

Short term administrator usage to install a driver isn't that big of a threat. The real problem will be legacy applications that won't run without administrator priviledges. That's what keeps most people from running everything as a user.

Re:Only works as an administrator but... (5, Insightful)

tcc3 (958644) | more than 7 years ago | (#15862666)

Legacy apps my ass. I've seen plenty of new, professional grade software that is hamstrung by user level permissions. Sometimes Power User wont even satisy. Sloppy development is a big problem.

You shouldnt be allowed to say "NT/2k/Xp compatible" if your software cant correctly handle user permissions.

Re:Only works as an administrator but... (2, Informative)

GIL_Dude (850471) | more than 7 years ago | (#15862712)

Although file and registry virtualization does make many legacy apps work fine. It doesn't fix the ones that needlessly checked directly for the administrator group being enabled in the token, but apps that write to system32 and program files and all work fine as a user now with virt.

Re:Only works as an administrator but... (2, Insightful)

just_another_sean (919159) | more than 7 years ago | (#15862701)

I've been using the Beta for a while now and what this low priveleged account amounts to is a dialog popping up when elevated privaleges are required and asking "Do you want to continue?". My understanding is you can now call CreateProcess such that it will load this dialog if elevated privaleges are needed.

Yes it's a great way to alert a knowledgable user that some background process may be playing where it doesn't belong but I still see thousands of end users blindly clicking "Continue" as with the old Active X warnings.

I think MS has made some great strides in this area. But they're going to have to "innovate" a lot more then this to solve the clueless user problem.

Re:Only works as an administrator but... (1)

swissmonkey (535779) | more than 7 years ago | (#15862451)

Actually, if you had read just a little bit about Vista before writing a useless post, you'd know that yes, all this will change under Vista. The administrator account is disabled by default and people will have to use limited accounts.

Re:Only works as an administrator but... (2, Informative)

Ruff_ilb (769396) | more than 7 years ago | (#15862456)

Yes, it WILL change if microsoft stops assuming that everyone can act as a full administrator, which they're going to do based on the latest beta.

http://www.anandtech.com/systems/showdoc.aspx?i=27 80&p=7 [anandtech.com]

The above article details a new "User Account Control" system. From TFA: "The basic premise behind UAC is that the previous way of running everything as an Administrator was wrong, and by doing so it not only allowed applications to make system-wide changes when they shouldn't, but it also meant that compromised applications could be used as a vector to attack the system. As a result, even an administrator isn't really an administrator under Vista."

Re:Only works as an administrator but... (0)

Anonymous Coward | more than 7 years ago | (#15862498)

So Vista will show a dialog saying "Installing this driver/software requires Admin privelidges"... most users will click Yes without reading it. Theres not really much difference except MS can now blame users for malware instead of default settings.

Re:Only works as an administrator but... (1)

crashelite (882844) | more than 7 years ago | (#15862460)

the adverage home user runs windows XP home what by default has the admin password blank and all you have to do i restart in safe mode to login as admin... but it is also by default dissabled unless in safemode...

Re:Only works as an administrator but... (2, Informative)

SEMW (967629) | more than 7 years ago | (#15862463)

Yes. The true administrator account is hidden and disabled by default. Most people won't even know it's there, and you have to go through a rigmarole to enable it if you really want it (these a how-to guide at http://www.computerworld.com/action/article.do?com mand=viewArticleBasic&articleId=9001970 [computerworld.com]). The "administrator" account that Vista creates by default is actually a standard user that can temporarily elevate to admin privelages on a task-by-task basis -- that's what UAC is about.

Re:Only works as an administrator but... (1)

portmapper (991533) | more than 7 years ago | (#15862509)

> The "administrator" account that Vista creates by default is actually a standard user that
> can temporarily elevate to admin privelages on a task-by-task basis -- that's what UAC is about.

Did Microsoft put a GUI on http://www.courtesan.com/sudo/ [courtesan.com] ;-)

Re:Only works as an administrator but... (1)

SEMW (967629) | more than 7 years ago | (#15862544)

> Did Microsoft put a GUI on http://www.courtesan.com/sudo/ [courtesan.com] ;-)

Pretty much...

Course, you know what this means now. All the people who'd previously spent all their time on Slashdot opinionating that Microsoft should adopt the Linux security model will now spend all their time on Slashdot opinionating that Microsoft stole the Linux security model :-/

Re:Only works as an administrator but... (1)

portmapper (991533) | more than 7 years ago | (#15862649)

> Course, you know what this means now. All the people who'd previously spent all their time on
> Slashdot opinionating that Microsoft should adopt the Linux security model will now spend all
> their time on Slashdot opinionating that Microsoft stole the Linux security model :-/

And at the same time complain that the latest binary-only driver from NVidia is not supported
by their Linux distribution of choice... Of course, they don't know that much of the basic
security in Linux predates Linux.

Re:Only works as an administrator but... (0)

Anonymous Coward | more than 7 years ago | (#15862467)

Considering that vista doesn't allow you to run as administrator, my guess is yes, they do think things will change with Vista.

Obviously, you've never even seen Vista running in person or you wouldn't have posted this comment. Not that that ever stopped anyone, this is slashdot afterall.

Re:Only works as an administrator but... (1)

nmb3000 (741169) | more than 7 years ago | (#15862488)

Do they think that anything is going to change for Vista?

One reason users run with administrative privileges in XP is because the XP setup it requires you to create a new user, and that user is given admin rights. Thus, the 'bob' user account that Bob made for his everyday use is an administrator, whether he knows it or not. Users get accustomed to having free reign over their systems and being able to make changes and install software without authenticating that it becomes the norm. In addition, there is a lot of poorly written programs and installers which punish the user for not running as admin by either completely not working or chastising the user with message boxes.

Microsoft can only do so much, and Vista is making some changes that will help, but it pretty much comes down to a paradigm shift that Windows users and developers will either accept or reject on a case-by-case basis. Hopefully it's the first step in a move towards a better system, but old habits die hard.

Re:Only works as an administrator but... (1)

smchris (464899) | more than 7 years ago | (#15862748)

the 'bob' user account that Bob made for his everyday use is an administrator, whether he knows it or not

Yup. People here are talking like "the darned user" is going to choose to run administrator. Most probably, administrator privileges is what the local Nerd Brigade outlet handed them. The behavior that has to be changed is at the retailer's shop. If Vista will get Windows techs to do an "su" instead of running admin, that is fine.

Re:Only works as an administrator but... (1)

WinBreak (982501) | more than 7 years ago | (#15862603)

"show me the average home user who doesn't runs XP as administrator. Do they think that anything is going to change for Vista?" -Yes. Because, by default, you won't perform an install as administrator. The Default user will be a power user. You'll have to be at least smart enough to log in as administrator and/or creat a 2nd administrator account to be signed on as an administrator. The default user will no longer be admin. Though, as of right now, even a "guest" user with limited privledges, has a way of signing on as an account higher than Administrator - it was also unveiled at the conference this week. Nevertheless - by the time Vista ships, there will be safeguards in place. You have to log in as administrator - AND the attacker that found the flaw had to run in virutalization - with the new plan for the DRIVER layer of the Kernel, by the time Vista ships, this won't be allowed, either (driver rating system, etc al.).

FIST SPORT! (0, Troll)

ringbarer (545020) | more than 7 years ago | (#15862426)

And it's amazing how many Linux vulnerabilites there are when you run random executables as root.

Ok, so the machine was in Admin mode... (3, Insightful)

twofidyKidd (615722) | more than 7 years ago | (#15862427)

Unfortunately, I think it's been established that many "average" users run in that mode, regardless of security concerns. I wonder if Vista will be an exception to this.

Re:Ok, so the machine was in Admin mode... (0, Redundant)

SEMW (967629) | more than 7 years ago | (#15862472)

Yes, it will. In Vista, the true administrator account is hidden and disabled by default. Most people won't even know it's there, and you have to go through a rigmarole to enable it if you really want it (these a how-to guide at http://www.computerworld.com/action/article.do?com [computerworld.com] mand=viewArticleBasic&articleId=9001970). The "administrator" account that Vista creates by default is actually a standard user that can temporarily elevate to admin privelages on a task-by-task basis -- that's what UAC is about.

Hmmm... (1)

MsGeek (162936) | more than 7 years ago | (#15862510)

...where have I seen that before? Where the true Root account is hidden and you have to go through a painstaking procedure to enable it? Where the "admin" account is actually a standard user that has to sudo to do Root-y stuff? Oh yeah, Mac OS X. And Ubuntu/Kubuntu/Xubuntu, which was influenced by Mac OS X to do the same thing.

Re:Hmmm... (0, Redundant)

SEMW (967629) | more than 7 years ago | (#15862564)

It's coming true exactly as I predicted in http://it.slashdot.org/comments.pl?sid=193364&cid= 15862544 [slashdot.org]! All the people who'd previously spent all their time on Slashdot opinionating that Microsoft should adopt the Linux security model are now spending all their time on Slashdot opinionating that Microsoft stole the Linux security model...

Re:Hmmm... (0)

Anonymous Coward | more than 7 years ago | (#15862626)

Actually your post "predicting" this occurrance occurred a full 5 minutes after the posts you claim it "predicted."

Are you claiming you can predict events that occurred in the past?

Re:Hmmm... (0, Offtopic)

SEMW (967629) | more than 7 years ago | (#15862663)

Is this in some alternative universe where 12:32 am is after 12:35 am?

My surprise was that is was coming true so quickly...

Re:Hmmm... (1, Funny)

Anonymous Coward | more than 7 years ago | (#15862620)

Was there some kind of point you were trying to make? That software developers 'steal' ideas from one another? What exactly do you expect?

Developer 1: Hey we really should get around to fixing this problem where all our users are running as root.
Developer 2: Can't. OS X already did it.
Developer 1: Damn.

Yeah, right.

Re:Ok, so the machine was in Admin mode... (3, Insightful)

TWX (665546) | more than 7 years ago | (#15862524)

That's because they have to run as a member of the Administrators group in order to do fairly mundane tasks like install software or make use of otherwise-mundane consumer hardware.

I've had accounts on POSIX-compliant systems for years. I've found that with only user-level access I'm quite able to compile or install applications for my own user account in my own home directory without much difficulty, and still maintain the system integrity. As long as Microsoft holds on to the registry they'll never achieve such.

Wow (1)

celardore (844933) | more than 7 years ago | (#15862443)

So, someone admitted that there is a vunerability in Vista. Among all the folk invited to 'test' Vistas security, someone had to come up with something. Even if they had to be administrator to do it.

It's the ones the black hats are keeping under their caps, or hats, that is going to be issue. But they can't all be trusted to tell. Not if they've found an especially 'useful' hole anyway.

Hypocrites (3, Insightful)

Umbral Blot (737704) | more than 7 years ago | (#15862447)

Lets see how long it takes for slashdot readers to swing into full hypocrisy mode. Specifically mocking windows because it is vulnerable to users running insecure software in administrator mode when every other OS has the exact same vulnerability. Of course windows users do have the unfortunate tendency to run as administrators, but 1- that is blaming the software for the problems of the user, and 2- Vista might be running in user mode by default.

And no, before you ask, I am not a windows user, I am on a Mac PowerBook G4. I prefer the mac because it is easier to use and I am not a gamer, not because of some imagined speed or innate security edge over every possible windows product.

Re:Hypocrites (3, Insightful)

swissmonkey (535779) | more than 7 years ago | (#15862477)

Even better, not only has the tool to run in administrator mode to work, but additionally, the user has to click "Yes" in a dialog box warning him that this program is touching sensitive parts of the system(that's the UAC part).

Now if that's a security issue, then I guess rm -rf / is an enormous security hole on Unix systems

Re:Hypocrites (1)

Drakin020 (980931) | more than 7 years ago | (#15862484)

We need more guys like you. The sad thing is your post prolly wont reach the top cause. *GASP* god forbit someone tells slashdotters there wrong. No one wants to tip them off there Linux stools.

But I feel ya man. Its easy for people to blame Microsoft, but really if you know what your doing you soon relise Microsoft is WAY better than other OS's (Based on what you want to use it for)

Re:Hypocrites (0)

Anonymous Coward | more than 7 years ago | (#15862558)

Some moroon modded him troll.

Re:Hypocrites (2, Informative)

SEMW (967629) | more than 7 years ago | (#15862487)

>Vista might be running in user mode by default.

Correct, it will. The true administrator account is hidden and disabled by default. Most people won't even know it's there, and you have to go through a rigmarole to enable it if you really want it (these a how-to guide at http://www.computerworld.com/action/article.do?com [computerworld.com] mand=viewArticleBasic&articleId=9001970). The "administrator" account that Vista creates by default is actually a standard user that can temporarily elevate to admin privelages on a task-by-task basis -- that's what UAC is all about.

Re:Hypocrites (0)

Anonymous Coward | more than 7 years ago | (#15862744)

If you're gonna spam the story with the same post, at least post the link correctly

Re:Hypocrites (2, Insightful)

TheUnknownOne (810624) | more than 7 years ago | (#15862539)

Speaking as a linux user who happens to also use windows to play games, while yes running in administrator mode in windows is "technically" avoidable, in reality it isn't. It isn't avoidable for your average home user who isn't going to try and figure out how to get all of his programs working with the limited user accounts. Microsoft as well as the majority of developers of Windows applications do not make any effort towards the simplification of this process, and they are at fault, not the average computer user who just wants to be able to get work done, and communicate with friends and family.

Re:Hypocrites (1)

loconet (415875) | more than 7 years ago | (#15862687)

1- that is blaming the software for the problems of the user

That's not true. The reason "windows users have the unfortunate tendency to run as administrators" is because some software requires Admin priviledges to run properly! That being said, those applications and the OS itself are to blame.

Re:Hypocrites (1)

bhmit1 (2270) | more than 7 years ago | (#15862801)

Lets see how long it takes for slashdot readers to swing into full hypocrisy mode. Specifically mocking windows because it is vulnerable to users running insecure software in administrator mode when every other OS has the exact same vulnerability.
I would agree with you, except that the hack was to run code that was unsigned when the OS was specifically designed with this security feature. If linux implemented something to prevent any executables from running that were not shipped from the distribution, and someone found a way to get around that, that would be a security hole, plain and simple. Not because other OS's do or don't have that feature, but because that feature was presumed to work and the user was expected to be able to trust it. If you can't trust an OS to implement the features they claim will make you secure, what about all the security features that they don't even offer?

Not only does it have to be in admin mode... (3, Informative)

Anonymous Coward | more than 7 years ago | (#15862448)

...but the user has to PERMIT the program to run.

Yes, many users are just stupid and will automatically click "yes" on things, but at that point it's their own damn fault. The hack won't work without the user letting it work.

Re:Not only does it have to be in admin mode... (1)

Ludedude (948645) | more than 7 years ago | (#15862464)

This is all a tempest in a teapot unless we know that Vista runs as admin by default, and not some reduced user privilege mode.

Re:Not only does it have to be in admin mode... (0)

Anonymous Coward | more than 7 years ago | (#15862548)

I don't like how exploits based on social enginering are labeld as full scale hacks. While it's nice that M$ protects people like my father against their own unknowing stupidity -he's about as old as the guys in congress and probebly knows just as much about it all- it'd be nice if I could turn it off when I want to change some settings. If you protect people against their own stupidity they'll never learn.

How's that even a hack? (1)

Sycraft-fu (314770) | more than 7 years ago | (#15862517)

I mean if I get you to run something as admin/root/whatever I can do whatever I want. I can own your system in any number of ways. If I do it with your knowledge (as in you clicked and chose to run the program) I fail to see how that's an exploit. The power to do what you want with a computer implies the power to break it. I can't very well give you full control over your own stuff, but not the control necessary to screw things up.

Calling anything that requires manual user execution a "hack" seems to stretch the term. Sure, I could give you a shell script that would own pretty much any Linux system when ran as root, but I wouldn't say that's a hack, that's just exploiting stupid users.

OMG (0, Flamebait)

Anonymous Coward | more than 7 years ago | (#15862452)

news at 11. Blackhats discover it is possible to compromise a machine if you have admin/root privileges. OMG, what are we gonna do.

seriously why is this even posted here, what moron considers being able to do nasty things when your an admin an OS based problem? if it is we all better pack up, go home and give up.

To be fair to MS (5, Insightful)

walnutmon (988223) | more than 7 years ago | (#15862474)

This article is a little slanted towards, "MS said you can't get into their OP, and black hats said, 'bitch please!'". But really, MS probably expected this, and was hoping that they could learn something from watching a collection of hackers test their system. The more problems that are caught now, the less when it is released.

Microsoft doesn't care about impressing Linux users, they care about releasing something that A LOT of normal users can install and forget about. Every iteration they get more stuff right, and their operating system becomes better (except ME, that sucked dick).

Re:To be fair to MS (1)

Jeff DeMaagd (2015) | more than 7 years ago | (#15862802)

It looks to me like compromising a box with superuser account. "Linux was hacked. To be fair, the target was running as root".

Blue Pill seems insincere (3, Insightful)

rufusdufus (450462) | more than 7 years ago | (#15862479)

She also admitted that she had to perform the hack in higher privileged administrator mode rather than the lower privileged user account control.

Seems to me this 'hack' gets the cart before the horse. If you are able to run malicious software in administrator mode, you can do anything at all, not just compromise signed code authorization. Heck you could replace the whole OS. The point of security is to prevent unknown persons from being able to run malicious software in the first place.

Re:Blue Pill seems insincere (0)

Anonymous Coward | more than 7 years ago | (#15862755)

You're conflating the Unix "root" account and pre-Vista "Administrator" with the Vista "Administrator" account. Traditionally, the Unix root account was a kind of "super-user". All authorization checks were disabled for UID 0 (aka root). Newer operating systems, i.e. SELinux and MS Vista, discard the super-user paradigm. There is no super-user in Vista. So, this was a legitimate break of the Vista security model.

On teh flip side, the question remains..... (1)

3seas (184403) | more than 7 years ago | (#15862490)

... how well does this superior security hamper productivity?
The most secure computer system is one that is not turned on.

'Admin Mode' (0)

Anonymous Coward | more than 7 years ago | (#15862500)

I dont know if any of you have done a bit of looking into Vista but MS is touting one of the main advantages of it as a limited user mode that actually works. Everyone runs XP as an administrator because most stuff wont work if you dont run as an admin. With Vista now the default accounts ARE all limited users and actions requiring admin privledged simnply prompt for an admin user.

Here we are in the same boat as any other os. If the user is stupid enough to
-always run as admin
-or freely allow things to run as admin mode when the dialog pops up

then its the users fault.

question (5, Interesting)

spykemail (983593) | more than 7 years ago | (#15862503)

The real question is: will elevating oneself to administrator become common practice or not? If admin land stay reserved for the likes of Slashdot, then problems like this will probably be greatly reduced. But that assumes that the difficulty in setting up an admin account isn't worth it for most people.

Re:question (1)

djbentle (553091) | more than 7 years ago | (#15862622)

Actually, even when running as Administrator, it may not be possible. Since in Vista, even when you're Administrator, you're not really Administrator until you explicitly escalate priveleges for a process by acknowledging a dialog. The difference is that you don't have to authenticate if you are Adminstrator, just click ok. I'm not sure whether that would inhibit this hack or not though. At most, you would merely need to click kk on the dialog.

Re:question (1)

SEMW (967629) | more than 7 years ago | (#15862648)

I don't think it will. The true administrator account is hidden and disabled by default. Most people won't even know it's there, and you'll have to go through a rigmarole to enable it if you really want it (these a how-to guide at http://www.computerworld.com/action/article.do?com mand=viewArticleBasic&articleId=9001970 [computerworld.com]). The "administrator" account that Vista creates by default is actually a standard user that can temporarily elevate to admin privelages on a task-by-task basis only with confirmation, like a normal user in Ubuntu who can use 'sudo'.

Re:question (4, Insightful)

morgan_greywolf (835522) | more than 7 years ago | (#15862664)

The real question is: will elevating oneself to administrator become common practice or not?


That depends on how many legacy programs require Administrator priveleges to even run. (Hint: a lot)

20 Year Mac User - Vista Is My Next OS (1, Interesting)

Anonymous Coward | more than 7 years ago | (#15862507)

Well, it is unless Ubuntu or one of the other Linux distros finally make that hurdle across the final 5% or 1% of making things 'just work' that seems to elude open source developers.

I've been very impressed with the latest Vista beta. I can't say for certain that it is secure but the small amount of time I've run it, I've had absolutely no security/spyware virus problems in normal day to day use.

It doesn't quite have that elegance that Apple has with the shading/highlights etc for the UI elements, but so far Vista has been stable, secure, and fast.

And I've been a foaming at the mouth Microsoft hater for the a long, long time. It looks to me like Microsoft has finally got their shit together with this OS. There was always a desire to get back to my Mac with previous Windows systems, not any more with Vista.

as I said (1)

joshetc (955226) | more than 7 years ago | (#15862530)

As mentioned in my previous post [slashdot.org]. They have their excuse for even more Vista delays. If you didn't read the old article they gave these "black hats" the authority to halt shipments of Vista until all issues are resolved.

Hardware bug (2, Informative)

diegocgteleline.es (653730) | more than 7 years ago | (#15862531)

This "trick" uses a hardware bug, not a sofware bug, to exploit Vista. It should affect other OSes like Linux, Solaris, BSDs, etc.

I'm not surprised that they focused on being able to break Vista. A nice marketing move for the "researcher" (like there're not papers that explain how virtualizing environments aren't 100% safe in the x86 architecture)

Re:Hardware bug (1)

mbakunin (258573) | more than 7 years ago | (#15862719)

Seconded. Someone needs to mod up this response, since this entire thread is completely missing the point of Rutkowska's work.

Unless her "Blue Pill" changed since it was last linked on Slashdot, it's a virtualization exploit. Since she refused to give any details on her blog when this was announced, I don't know how she gets around attestation. Perhaps that's the Vista-specific part.

'Bring em' On' (0, Troll)

reidleake (818488) | more than 7 years ago | (#15862533)

We all know the results of "Bring em' on" bravado...

Next will he be standing under a "Mission Accomplished" banner, despite the obvious failure?

And Linux as root is any more secure? (2, Interesting)

CorporalKlinger (871715) | more than 7 years ago | (#15862559)

So let's see, if you run an application as "Administrator" on a new Windows Vista machine (where users are not, by default, created as administrator accounts), that application could cause problems with the system or, if you will, "hack" the system (such an unclean word). How is this any different from sitting down at a Linux system with root access and running amok? Are root accounts inherently more secure than administrator accounts, or am I missing something here? At least on the Vista machine, a notification box may appear letting you know something is going on. See if "rm -rf /" on a Linux machine even asks you to verify your entry before it executes. Microsoft has made it clear that Vista users won't run as admins by default, so I see this as a non-issue. Why does it even qualify as "news?"

Re:And Linux as root is any more secure? (1)

userlame (885195) | more than 7 years ago | (#15862704)

See that -f switch in the command you posted? That means force or in other words don't ask me to verify my entry. I certainly don't want software asking me questions I've already answered.

Re:And Linux as root is any more secure? (1)

BCW2 (168187) | more than 7 years ago | (#15862769)

Could it be because close to 90% of all Winboxen run in Administrator mode? That is the default in every version before Vista. It will get changed to Admin by most regular users to install something and left there in Vista. The users don't understand and not enough people who do have a clue are teaching them.

amok? (0)

Anonymous Coward | more than 7 years ago | (#15862807)

I tried ./amok but nothing happened?
Do I need to chmod +x /usr/bin/amok or something?

since when? (0, Flamebait)

wardk (3037) | more than 7 years ago | (#15862565)

this comment:

"Microsoft's most secure Operating System yet has been compromised at the Black Hat hacker conference.

MOST SECURE???? based on WHAT evidence??

what's that? there is NO evidence that this is the case? I thought so.

Re:since when? (1)

WinBreak (982501) | more than 7 years ago | (#15862638)

That's MICROSOFT'S MOST SECURE OS YET - not THE WORLD'S MOST SECURE - Microsfot's "best yet." Learn the language before bitching about it, please.

Re:since when? (1)

Flame0001 (818040) | more than 7 years ago | (#15862773)

Perhaps you should reread what he said. He was speaking of "most secure" in the context of Windows. "Most secure in the world" is not implied.

Ok, *puts in devil suit* (1)

kennedy (18142) | more than 7 years ago | (#15862576)

Look, you have to hand it to microsoft here - they are at least TRYING. I really get the feeling that someone, somewhere inside redmont finally got a clue and got them fired up about really cracking down in terms of security. Look at the 360 (yes, there is a firmware hack for the dvdrom drives, but that is not mucking with the internal security), and how long Vista has been delayed and re-written.

I know this sounds a little crazy (trust me, i hate that I'm having to even write this post), but i really think MS is giving it the ol' college try from here on out...

Re:Ok, *puts in devil suit* (1)

MattS423 (987689) | more than 7 years ago | (#15862750)

too bad a "College try" consists of staying up pumping yourself up on Red Bull and forcing yourself to work on it until 3am.

Security Development Lifecycle (4, Interesting)

SafariShane (560870) | more than 7 years ago | (#15862587)

From the article...

Reportedly, Vista is the first Microsoft products [sic] that the company is sending through its "Security Development Lifecycle", which aims at getting rid of all security vulnerabilities before shipping.

Begs the question(s)...

1. Why didn't microsoft try to get rid of all security vulnerabilities in other releases prior to shipping?

2. Who at microsoft would even claim such a thing?

Most security experts understand that 'security' is an arms race. I for one would rather measure the security of an os by the mean time between discovery and patch implementation. Microsoft is half right, they have the most vunerabilities because they are the dominant os, thus the biggest target. (yes, I know it's easier to hack ms, but that's not my point here) Even if Vista is far more secure and much harder to hack, if it has the largest install base it will have the most vunerabilities.

I take issue with this part of the artice...

She also admitted that she had to perform the hack in higher privileged administrator mode rather than the lower privileged user account control.

Since when did that make any bit of difference? Hackers have been using social engineering tricks since they were called phreakers. And most people forget that it's purely a numbers game. They don't expect every end user to fall for an email titled "i love you" or "free pron". But, a small percentage will take the blue pill, and some of them will even switch to admin mode when the cute little screen saver they won for being the 500,000th visitor to some domain misspelling.

Getting rid of ALL venerabilities? Ha, not even cutting the network cable could do that. There is always sneakernet. I for one want to run a system where zero day vunerabilites are just that, around for zero days.

These kinds of contests don't work. (2, Insightful)

Poromenos1 (830658) | more than 7 years ago | (#15862591)

This contest doesn't make sense, if they find a vulnerability, it's some bad PR, but, well, how many vulnerabilities have been found and patched for XP? If they don't, it still doesn't mean it's unhackable, it just means they need more time.

The only case where they DO work is when you're asking people to crack encryption, and then it's only CRACKING it that proves something, saying that noone could crack it doesn't mean it's uncrackable.

Missing the point, I suspect (1)

overshoot (39700) | more than 7 years ago | (#15862658)

Hmmm.

As I read it, Microsoft has declared that as of their next release, they simply won't allow unsigned drivers and other kernel-level code to run. Which, according to quite a few hardware vendors, means enough expense to be prohibitive; those same vendors today simply provide instructions to ignore "this code isn't signed" warnings.

Well, this hack lets those vendors continue as they bear.

The posts about "well, DUH! you need admin privs" is beside the point because driver (etc) installations always have. The news is that Microsoft has been trying to change that, and (at least for now) failed.

freeware? (2, Interesting)

colmore (56499) | more than 7 years ago | (#15862667)

So does this mean I'm going to need to be in administrator mode to run free software?

Since just about everyone runs one or two pieces of free software (Windows isn't capable of very much out of the box) doesn't this mean that *everyone* will still be running in administrator mode?

The Majority of Executables are Unsigned (1)

Bendejo (894944) | more than 7 years ago | (#15862702)

Did it ever occur to anyone that the majority of executables and drivers, even legitamate ones, are not signed? So what this article doesn't say, but suggests is that MS's solution to the whole security thing is to block out all unsigned exe's. Am I wrong?

The blue pill? (-1, Troll)

Anonymous Coward | more than 7 years ago | (#15862721)

Stop it with the fucking Matrix references. The Matrix was hardly even a good film let alone it's two sequal that SUCKED ASS. I say fuck the Matrix. It sucked and people who just can't get over the film and get on with their real lives are borderline psychotic.

BTW: Just so you Matrix idiots know; Best Buy had all three films and the "aninmatrix" at 5 USD each... it's fucking bargin bin fodder for the fucking masses. No philosophy, no great CGI.... just another loser film that 12 year old fags still run around quoting because they can't see beyond their noses.

Quite simple (0)

Anonymous Coward | more than 7 years ago | (#15862758)

It's quite simple to run unsigned code. Use bcedit or VistaBoot to edit the boot configuration to allow you to run unsigned code and you're set.

Ha - haa! (0, Offtopic)

cachimaster (127194) | more than 7 years ago | (#15862770)

Bill, your puny OS has been hacked by ... a GIRL! bwa ha haaa
wait...
Man, she is a babe! [hackinthebox.org]
I saw her first!!!
*runs to buy airplane ticket*

What about Visual Studio users? (2, Interesting)

splorq (839609) | more than 7 years ago | (#15862804)

Visual Studio has to run in admin mode. Okay, IFF you want to use the debugging facilities you need to be an admin. But how often would you not want to use the debugging facilities when you're developing code? And how many developers are only going to use admin mode when they need to do some debugging? Perhaps this will be fixed in the first version of VS for Vista. I wouldn't risk much of my annual income on it.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...