Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Tricking Vista's UAC To Hide Malware

kdawson posted more than 7 years ago | from the protective-coloration dept.

Security 221

Vista's User Account Control, love it or hate it, represents a barrier against unwanted software getting run on users' computers. A Symantec researcher has found a simple way to spoof UAC and says that it shouldn't be completely trusted. The trick is to disguise the UAC warning dialog in the color associated with alerts generated by Windows itself.

cancel ×

221 comments

Sorry! There are no comments related to the filter you selected.

Importance? (3, Funny)

MrNonchalant (767683) | more than 7 years ago | (#18151678)

"Would the user treat this UAC with the same amount of caution?" His answer: No. Users will, as Microsoft intended when it selected those colors, note the teal border of the spoofed UAC and likely click through without a second thought, he said.
I've been using Vista for a month. There were color differences?

Re:Importance? (2, Insightful)

leuk_he (194174) | more than 7 years ago | (#18151812)

Never noticed these colors as well.

I did try to cut the number of warnings given, but uac still is not yet at a level it is user friendly.

Let me point out:
-It sometimes tells the publisher is unknown, and sometimes it show the publisher, but say it is unverified. It is just a conspiracy with verisign [microsoft.com] to sell code signing certificates.
-Java vm had fine grained access controls [unix.org.ua] a long time ago, and the NSA build these into windows NT 4.0 also. But all UAC allows is to give full access(=admin that can install drivers) or deny (no option most of the times) it. Yes, you can apply all kind of rights to the user, but not to a program... This is a lost opportunity.
-Once UAC is popping up you have no way to take back control. So guess what a user does when he is confronted with {while (true)askPersmissiontoinstalltrojan;}
-...???
-profit. Yes for Steve Ballmer that is... ;)

Re:Importance? (3, Interesting)

gunnk (463227) | more than 7 years ago | (#18152026)

What I want to know is if the system can't tell that *I* double-clicked on an icon to start a program, how does the system know that *I* clicked "Allow"?

If I had to enter my password to continue I would understand the difference, but just a click to continue? Does this work at all?

Re:Importance? (3, Interesting)

MrNonchalant (767683) | more than 7 years ago | (#18152098)

The environment you click that button in is a separate and theoretically secure desktop. That's why the screen dims: to indicate that. It's the same armor that protects your Windows password from keyloggers. Whether or not it's secure remains a largely open question. There are no exploits I've heard of to breach it, and Microsoft would (eventually) patch said exploits if they became apparent.

Re:Importance? (1)

Asztal_ (914605) | more than 7 years ago | (#18152144)

The difference is that for the UAC dialog the system switches to a system-owned desktop (note that I am using the word "desktop" in the sense of the Win32 programming model), which programs on your application desktop can't access. They then also can't control or read from the mouse or keyboard. Basically, the only way they could click "allow" for you is if they baddies had installed an evil driver or maybe replaced core system files which generated the prompt, in which case you've already lost.

It's similar to the way that when you press ctrl-alt-delete on Windows NT, it switches out to a different desktop (the idea being that since only the system itself can trap Ctrl-Alt-Del, you know it is definitely the system which created the desktop on which you are entering your credentials).

Re:Importance? (1)

Ed Avis (5917) | more than 7 years ago | (#18152700)

When you press Ctrl-Alt-Del in Windows XP it doesn't always block other applications from accessing the screen that appears. I'm sure I've seen third-party software display random crap dialogue boxes (often crash dialogues) on the login screen, and another example is that StickyKeys thing you can sometimes activate by pressing Shift five times. The principle of having a secure attention sequence is good though.

Re:Importance? (2, Informative)

Asztal_ (914605) | more than 7 years ago | (#18151946)

I guess if you didn't notice, it's possibly because you knew what you were doing at the time and just clicked allow/continue without second thought. Or maybe you just didn't install/run unsigned software, which would generally be a good idea anyway.

This is essentially allowing a trusted program (RunLegacyCPLElevated.exe) to load and execute untrusted (unsigned, etc) code in its own, trusted, context... I don't see how that can possibly be secure, or how they can say it's not a problem. The obvious choice to me is either to display a notification when a "trusted" process running with full privileges dynamically loads an untrusted DLL (then again, that might get annoying, in which case they could have implemented some sort of flag in the executable's manifest meaning "this program may link with untrusted code, if it does at some point do that, then afterwards treat it as unsigned"). N.B.: I could be talking out of my arse here.

For reference, sometimes it just asks you if you want to allow an unnamed program - that's the orange dialog with the choice "allow/deny". It's not digitally signed, or the signature isn't trusted, so there is no reason to trust who it says it's from (I'm not saying digital signatures are foolproof, but they help), so it doesn't even say what program wants to do X or who it is from. Other times, it tells you who signed the software and that you should run it if you trust the signer - that's the grey/teal one with the choice "continue/cancel".

Re:Importance? (1)

leuk_he (194174) | more than 7 years ago | (#18152912)

I am using/installing open source software. Since vista was/is new to me i have to carefully read what it press. But open source software is seldom digitally signed. The only value of a digital signed is that you know who wrote the software, it will never say anything about quality, and so far it never was about any guarantee made by the supplier of the software.

If ths software is supposed to come from a major publisher, (like Microsoft, or adobe, or symantic) it might be worth something. However if you run a game that is signed by some lessknwon studio that is a publisher for some other softwarehouse, you cannot determine if the signee is the one that is actually supposed to be the one distributing the software, so the signature is almost worthless.

It could have least ALWAYS show the not trusted publisher.

But dumb users will either have UAC disabled or learned to press the "Yes/Ok".

One thing good from this is that software will be written to be run as Normal user instead of administrator. That is the good thing about UAC.

I surprised you saw UAC at all. (0, Troll)

twitter (104583) | more than 7 years ago | (#18152232)

I've been using Vista for a month. There were color differences?

As people [slashdot.org] have noticed [slashdot.org] , M$ has made UAC such a psychotic pain that no one is going to use it. They are all going to be running as root all the time. People have also speculated that this is so M$ can blame the user later. Vista is going to have the same kind of four minute half life on any network as XP did, regardless of market share, and no user action will be required.

The problems the current article points out are just icing on the cake and will always exist for a non free OS. Users are forced to trust software companies that don't trust each other and despise the user. These companies refuse to co-operate and frequently sabotage each other to gratify themselves. The net result is systems crawling with easily exploited ad, spy and malware. Community inspected free software, like Debian, is the only kind of software users will ever be able to trust.

Re:I surprised you saw UAC at all. (2, Insightful)

ThePengwin (934031) | more than 7 years ago | (#18152660)

People have also speculated that this is so M$ can blame the user later. So they went through all the trouble to try and create a system which lets users know more about whats happening to tell them that in the end its all your fault if you get a virus? Why not just say in the EULA "Dont click anything, it could be a virus/worm/trojan/spy ware/ad ware. We wont help you then"? Furthermore, why does windows have so much support then? why are there updates? Its not "Deal with it yourself", its most likely "We cant protect you from it all, but we will try" As for a non free OS comment, People use non free OSes these days because they honestly dont know how things work, and wont spend the time to. Its the same reason why anyone can build a car, but noone really does.

Re:I surprised you saw UAC at all. (1)

zlogic (892404) | more than 7 years ago | (#18153022)

The problem is that most WinXP apps need admin rights without any reason, and that's really insecure 'cause you need to be admin to do any serious work. So MS decided that running such apps should be a pain in the ass - at first it will be bad, but once developers rewrite things to works a standard user (and they will be forced to do it, or users will get mad), UAC warnings will appear when something does really need user attention.

Re:I surprised you saw UAC at all. (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18153528)

So MS decided that running such apps should be a pain in the ass - at first it will be bad, but once developers rewrite things to works a standard user (and they will be forced to do it, or users will get mad), UAC warnings will appear when something does really need user attention.

Except that by default, whether it needs permission or not, installers ask for and run with admin permission. That means developers have no motivation to to stop writing installers that require administrative permissions and malware writers' trojans that ask for suck permission will not stand out even if developers did change their behavior for some other reason.

Re:I surprised you saw UAC at all. (1)

benzapp (464105) | more than 7 years ago | (#18153312)

I think your signature shows you to be the zealot that you are.

UAC is not that big of a deal.

paraphrase (2, Interesting)

physicsboy500 (645835) | more than 7 years ago | (#18151684)

I love Microsoft's response:

Meh... the same users who show enough common sense to click on the "you've won a free ipod enter your credit card information here" will obviously be able to know the difference between a good system message and a bad system message

Hooray for apathy!

Re:paraphrase (5, Funny)

risk one (1013529) | more than 7 years ago | (#18151870)

Hooray for apathy!
Meh... it's alright, I guess. I could take it or leave it.

I don't know which is worse.... (1)

StressGuy (472374) | more than 7 years ago | (#18152824)

The apathy demonstrated by M$ or thier sheer ignorance

meh...who knows?....who cares?

{so, is this joke beaten to death yet :) }

Oblig. Simpsons (1)

TheVelvetFlamebait (986083) | more than 7 years ago | (#18152842)

Lisa: We're from the MTV generation; We feel neither highs nor lows.

Homer: Wow! How does that feel?

Lisa: Meh...

Re:paraphrase (3, Funny)

SydBarrett (65592) | more than 7 years ago | (#18152116)

So, Vista is gonna prevent me from winning Ipods?

Screw that, if i'm the 999,999th vistor I deserve a prize and I dont care what no washington computer fatcat wants to do with my internet windows.

Re:paraphrase (1)

apathy maybe (922212) | more than 7 years ago | (#18153374)

What's the difference between ignorance and apathy?
I don't know and I don't care.

Its tricking the user as much as Vista (2, Interesting)

Chrisq (894406) | more than 7 years ago | (#18151688)

Basically its a way to get a green pop-up, which usually means safe applications. It relies on the user blindly saying "yes" to these green pop-ups

Re:Its tricking the user as much as Vista (3, Interesting)

POTSandPANS (781918) | more than 7 years ago | (#18152158)

After using vista for about an hour on a customer's computer, I was pretty much trained to click yes on all those things too.


The problem is that while we may actually read those warnings, most users are going to see it as an extra step they need to do in order to get their free ipod/car/vacation/porn. It wouldn't surprise me if directions to help users "get rid of those annoying uac popups permanently" soon show up on a few malware-providing websites. Just look at the firewall rule set on some people's computers.

No tricking involved (4, Insightful)

LinuxGeek (6139) | more than 7 years ago | (#18152206)

The main problem I have seen with Vista since the first RCs is the monotonous regularity that these messages pop up with during regular system use. The old adage that practice makes perfect is incorrect; Practice makes permanent is the real outcome and microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

I have found myself clicking continue at the same time my thought registers to *not* click because of something not looking quite right. Since I am no longer developing software for a living, the only OS on my system is Ubuntu! Thank God for Debian, Ubuntu, Red Hat, et al. for their tremendous efforts to give everyone a reasonable alternative; whether we choose to use it is certainly a choice, but we do have the choice.

Re:No tricking involved (3, Insightful)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18153074)

...microsoft is basically forcing their customers to practice hitting that continue button while still trying to concentrate on the tasks at hand.

The "OK/Cancel mistake" has been in usability textbooks as an example of what no to do for more than a decade now. It is quite clear to anyone who has had any formal training in human-computer interaction that either MS hires the worst UI people on the planet, or the marketing department overrides all of the UI people's proposed changes. It is also clear that either MS is only vaguely aware that UI deign is an important part of security, or they are a lot more interested in providing the perception of security than the reality. My opinions is that Vista security is a lot like searches at the airport. For the most part it is completely ineffective at actually increasing overall security when it is important, but it is very, very visible and "in your face" so people assume "something is being done" and are mollified.

Re:No tricking involved (1)

MORB (793798) | more than 7 years ago | (#18153480)

I think the only actual purpose of those UAC dialogs is just to shift the blame to the user (even though most probably end up always clicking ok without looking out of habit) if something goes wrong.

Re:No tricking involved (0, Troll)

Mister Whirly (964219) | more than 7 years ago | (#18153704)

"MS hires the worst UI people on the planet"

Wait, I thought Vista stole it's UI from OS X, which supposedly has the best UI on the planet. Hmmm...

Re:No tricking involved (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18153864)

Wait, I thought Vista stole it's UI from OS X, which supposedly has the best UI on the planet. Hmmm...

You're probably trolling, but on the off chance you're not, I'll respond. While a lot of both the feature set and the graphic effects in Vista seem influenced by OS X, the UI itself is still pretty much based upon Windows 95. Just because you are copying elements from a UI, by the way, does not mean the end result will be usable if you don't copy everything exactly and don't understand why certain elements were used in certain ways. For this particular case, you'll note OS X itself does not run afoul of the OK/Cancel mistake, because they name all buttons for real actions (OK is not a verb) and provide unique dialogue boxes and buttons for each occurrence and as rarely as possible.

Re:Its tricking the user as much as Vista (0)

Anonymous Coward | more than 7 years ago | (#18152826)

XP has gotten me to blindly click the "close" X on those damned yellow balloons that pop up. "There are unused icons on your desktop" (If I didn't want them, I have a "delete" key. click) "Warning: Windows Firewall is turned off" (of course it is - I'm running ZoneAlarm. click) "There are unused icons on your desktop" (You already told me that, asshole. If I wanted to be nagged I wouldn't have divorced the bitch. click) "The current document did not print correctly..." (click. Huh? What did that say?)

(Mind Reading Capcha = "accident")

Re:Its tricking the user as much as Vista (1)

Mister Whirly (964219) | more than 7 years ago | (#18153830)

You can turn off the Security warnings in the Security Center under the control panel, and clicking the Change the way Security Center alerts me.

You can turn off the Desktop Cleanup Wizard by going into the Display Properties and clicking the Customize Desktop button on the Desktop tab and unchecking the box that says "Run Desktop Cleanup Wizard every 60 days".

You can turn off printing notification by going into Printers and Faxes and from the File menu, select Server Properties. Click the Advanced tab, and then check or uncheck the checkbox next to Notify when remote documents are printed to either enable or disable the printing notification.

Maybe instead of blindly clicking close notifications, you should actually spend 5 seconds googling and figure out how to change the interface. XP really isn't too hard to use if you spend some time learning about the features.

Not an issue (3, Insightful)

picob (1025968) | more than 7 years ago | (#18151692)

I couldn't say it better than a header in TFA:

Microsoft: Not an Issue

Re:Not an issue (0)

Anonymous Coward | more than 7 years ago | (#18152972)

Of course its not an issue: OS security has nothing to do with exploitable third-party applications, which this exploit requires in order to function. OS working as intended, exploitable 3rd party apps still cause problems--but will warn you before they cause damage.

Re:Not an issue (1)

Zantetsuken (935350) | more than 7 years ago | (#18153422)

I think he meant it as a play on what they said - that MS Corp isn't an issue... but thats just the way I read it...

We need to cut down on the complexity. (4, Insightful)

Anonymous Coward | more than 7 years ago | (#18151700)

With every release of Windows, Microsoft seems to devise some new, overly-complicated scheme to try to protect Windows users. The scheme they came up with may sound great, but then it falls flat on its face because of some minor flaw or workaround.

So maybe what they need to do is to get back to the fundamentals. We only need to look as far as OpenBSD to see how keeping things simple and intelligent results in a very secure operating system. Instead of writing new (and probably buggy) code to try and prevent things like malware, they just repeatedly go over the code they already have, to try to ensure that it is exploit-free. And it works. OpenBSD is a damn secure system.

Re:We need to cut down on the complexity. (1)

John Nowak (872479) | more than 7 years ago | (#18151850)

Oh please. OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is. User level permissions are more than sufficient to start up some malware automatically every login, not to mention sufficient to wipe out all of your important data. (No, /usr/bin generally isn't that important.) I love OpenBSD, but please, be rational.

Re:We need to cut down on the complexity. (3, Insightful)

peragrin (659227) | more than 7 years ago | (#18152152)

Why don't you be rational. So that user's directory get's trashed. but trashing that directory also kills off the malware. If it doesn't a simple search for that user's remaining files will. All that remains is a simple backup restore and your good to go. total time to repair maybe an hour.

To clean a Windows box means reinstalling the entire damn thing.

It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked, unlike Windows up to XP which it can be fully automated. I will hold off on final Vista judgments until more information can be gathered.

To Quote Scotty in Star Trek III The more they over think the plumbing the easier it is to stop up the drain.

Simple *nix user level security has proven for over 20 years to be more effective than anything MSFT has produce in the same amount of time.

ACL's make life easier for large installs, but it is the small ones that cause the most problems. That is why large *nix installs use both.

Re:We need to cut down on the complexity. (0)

Anonymous Coward | more than 7 years ago | (#18152364)

>> So that user's directory get's trashed. but trashing that directory also kills off the malware.

That user directory is for 99% of the systems THE ONLY DIRECTORY WHICH MATTERS.
I don't care if I lose all the OS binaries. I care for my photos, my documents, my mp3s. And at work for my source codes.

It's the same like saying "this car is much more secure! You see in case of accident all the passengers die anyway, but the engine still works!". Wow.

Re:We need to cut down on the complexity. (1)

caluml (551744) | more than 7 years ago | (#18153036)

It is also a lot harder to use a *nix based box as a botnet zombie. It isn't impossible, but each machine has to be manually cracked

Eh? Says who?

Re:We need to cut down on the complexity. (3, Insightful)

MajinBlayze (942250) | more than 7 years ago | (#18153314)

To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing all documents/etc is marginally better than reinstalling the whole OS. There is no reason that an application should have this kind of permission, IMO, we need to look past user level permissions to application level permissions, as this is where real security exists.

Re:We need to cut down on the complexity. (1)

MajinBlayze (942250) | more than 7 years ago | (#18153388)

Sorry, that looks a little trollish: I should point out that I am a happy user of Gentoo Linux. My personal opinion on linux is more that it is infinitely customizable than infinitely secure.

Re:We need to cut down on the complexity. (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18153792)

To the *NIX crowd: Please, please, please stop trivializing the destruction of a user's home folder. For home use, there is rarely more than 1 user, and loosing[sic] all documents/etc is marginally better than reinstalling the whole OS.

There is one important reason why compromising a user account versus compromising a machine makes a difference and that is, just compromising a user account does not necessarily give a worm author sufficient access to add a machine to a useful and profitable botnet. As such, even if a worm author can destroy everything in the user's home directory, they aren't going to because it doesn't make them any money. Being so poor you can't afford shoes won't help you outrun any muggers, but it is likely to decrease your chances of being mugged in the first place.

There is no reason that an application should have this kind of permission, IMO, we need to look past user level permissions to application level permissions, as this is where real security exists.

I 100% agree on this point. It is long past time Windows made use of NT's ACL capabilities. I'm hoping Apple gets their MAC and signing frameworks up and running correctly in the next few years so MS has something to copy.

Re:We need to cut down on the complexity. (1)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18152936)

OpenBSD is just as susceptible to someone downloading an evil binary and clicking "Yes" as Windows is.

This is not exactly true. On OpenBSD finding a local elevation vulnerability to allow you to root the machine from an untrusted account is nontrivial. To date, that is not the case with Windows, including Vista which already has unpatched, outstanding elevations. Further, on OpenBSD the user can install software as the local user for the most part, whereas users are prompted for admin access to run installers, by default, in Windows. Finally, you can install TrustedBSD and run said malicious evil binary without any real risk.

In general, however, I think you're correct. Microsoft should not be looking at the average OpenBSD install as the model for their security because Windows has a different set of problems than OpenBSD. Windows is constantly being subjected to attacks by malware and if OpenBSD was subjected to the same level of attack, it would adapt and develop more secure methods. MS should be looking at TrustedBSD or SELinux as the model for their security. Copying OpenBSD (which is sort of what UAC is an attempt at) is not sufficient to actually solve their problems.

In order to provide users with a secure desktop, MS has to innovate and be one of the first to adapt ultra-secure MAC type security in a novice user desktop. Sadly, MS is not exactly up to the challenge of innovating much of anything, especially when three vital components of such a system are fundamental security, user interface design, and competitive third party integration. MS constantly puts marketing and bundling ahead of security, makes terrible UI choices, and uses every new feature to lock out competition rather than invite it in some market. As such, I don't believe they are capable of providing a secure OS.

Re:We need to cut down on the complexity. (0, Troll)

jt2377 (933506) | more than 7 years ago | (#18152764)

how in the hell is UAC any different than su in *nix? how the fuck can you say UAC is overly-complicated scheme when *nix used the fucking "UAC" for over years. you Sir is a fucking tool.

Re:We need to cut down on the complexity. (1)

dioscaido (541037) | more than 7 years ago | (#18153424)

The security model in BSD and Windows are the fundamentally same. Resources on the system are protected by access lists defined for users/groups. Administrators/Root have full access to change anything in the system, absolutely no way around that. Windows screwed the pooch because in its migration from Win98 (single-user, no security) to the Win2k/XP platform (already mature user and ACL implementation) they had to keep app compat or lose the market (computers were not powerful enough to get virtualization in the picture yet). So, applications expect administrator privileges, and hell even parts of the OS are guilty of this (i.e. - double click on the taskbar's clock as limited user in XP).

With this as background, their task in Vista is huge. You can't keep users running as Administrator and be secure, period. The same thing would be true of linux if everyone ran as root. But the biggest selling point for Windows is app compat. So we have a middle ground to affect a transition between a Admin and a non-Admin world -- UAC. People are still administrator, but under most circumstances (before the UAC prompt) everything runs as limited user. App compat issues are partly fixed with virtualization that allows admin apps to run as limited, but most are solved by simply asking for admin access, but just for these applications. Slowly the whole application ecosystem moves to limited user supprt, and UAC prompts are fewer and far between. I would expect that in the next windows UAC will be much different, if non existent.

In either case, like MS says, UAC is not a security boundary per-se (although it can be used as such). Common sense should dictate that if you get a prompt out of the blue, green or non-green, you should cancel.

Different colors?? (4, Interesting)

drawfour (791912) | more than 7 years ago | (#18151712)

While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell), so why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

To be honest, Vista's UAC saved my butt recently. I have no idea what application was vulnerable -- but it somehow tried to run exec.exe, which was downloaded into one of my temp folders. The file was deleted after it failed to run (because I said "no"), and then would appear back in a few seconds and try to run again. I'm happy that whatever application was vulnerable wasn't able to do anything to my system.

<tangent> Anyway, while some people may say it's annoying, I'm not sure exactly how many actions a typical user would take that would require UAC prompts. After the first few days of configuring, installing apps, etc..., I have little need to do anything that requires UAC prompts. Defrag is set up to run every night, anti virus is set up to download updates, my resolution settings don't change, etc... </tangent>

Re:Different colors?? (1, Insightful)

Anonymous Coward | more than 7 years ago | (#18151842)

While it may be true that different colored borders are supposed to mean varying levels of "trust", as in what component is running, I don't think any user would know that. The text in the dialogs doesn't appear to be different (that I can tell), so why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

One of the problems is that you can set the "green" ones to be always accepted in corporate networks to allow users to run certain programs that are part of Vista. So yes, this has some potential to do damage.

Re:Different colors?? (1)

Denial93 (773403) | more than 7 years ago | (#18151924)

> why would a border color make me go "Oh, I should let that action happen, I bet that's some Control Panel action", especially when I wasn't working with the control panel.

Colorcoding is an attempt to make the user differentiate, not a piece of extra information.

Consider the situation of the unknowing user, who is confronted with a warning but has insufficient information on its meaning. There will be many of those. In some cases, denying access can give no feedback, in others it can immediately make important things not happen, i.e. negative feedback. Allowing it will almost always result in no feedback because the nasty code, if present, works in the background. In the absence of other information, users will usually attempt to avoid negative feedback, i.e. will establish a semi-conscious always-allow habit. M$ is not trying to educate the user (because users don't like to be educated, least of all in the middle of other work), they are trying to break the uniformity of some users' response to warnings.

Re:Different colors?? (0)

Anonymous Coward | more than 7 years ago | (#18151968)

Uh I don't know about you, but a deleted file that keeps reappearing and trying to run means that your system already has been compromised.

how else would the file keep resurrecting? Unless IE is automagically downloading files and trying to run them for you?

Another reason to use FF with scriptblocker.

Re:Different colors?? (1)

codepunk (167897) | more than 7 years ago | (#18152104)

Exactly what I was thinking, makes you feel all warm inside that vista is letting you know your
box is already owned.

Re:Different colors?? (2, Insightful)

dysfunct (940221) | more than 7 years ago | (#18151992)

I don't think any user would know that.

I wouldn't be too sure about that. The article mentions that "the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system". Since this dialog will likely pop up frequently with a low chance that the user triggered it unintentionally (i.e. the user knows what he/she is doing) it might actually lower the barrier of clicking "Allow".

Don't forget that even though a user might not consciously notice the color after a lot of usage and especially repetition the brain might subconsciously notice the difference between a red (not as often appearing -> think twice) and green (frequently appearing after normally trusted "system" action -> just click on the damn thing) border and act accordingly.

Re:Different colors?? (1, Troll)

kingturkey (930819) | more than 7 years ago | (#18152146)

Having to click through 3 different prompts in order to delete a file was enough for me to disable UAC. It lasted about 2 days on my computer.

Let me get it straight. (1)

140Mandak262Jamuna (970587) | more than 7 years ago | (#18152792)

Somehow an unknown executable ended up in your temp folder. You have no idea how it did. Some application is trying to run that unknown executable every few seconds. You dont know which application is doing that. You dont know what else that application is doing to your system. But you think the UAC has saved your butt. And further suddenly all UAC dialogs stopped. Instead of asking yourself with much trepedation "why?" you become happier! "All others are getting the annoying UAC dialog. But whatever malware is in my system does not bother me with UAC, it got all the authorization it wanted."

This is what the other guy said, "Vista is designed to make you feel warm and fuzzy and happy while your machine is being rooted."

Re:Different colors?? (1)

mrcdeckard (810717) | more than 7 years ago | (#18153300)

The file was deleted after it failed to run (because I said "no"), and then would appear back in a few seconds and try to run again. I'm happy that whatever application was vulnerable wasn't able to do anything to my system.
this is what drives me crazy about windows. ok, so you kept the file from running, but you said it reappeared a few seconds later. weren't you interested in where it was coming from? to me, windows' file structure and that mess the registry are so convoluted that there isn't any hope of cleaning them out. when i find out malware has infected my system, i grab the system disk (always within arm's reach of the windows box) and reinstall.

i'm no system admin expert, but i feel that i can at least *navigate* the system in linux and os x....

mr c

C'mon, give MS a break here! (5, Insightful)

pla (258480) | more than 7 years ago | (#18151726)

That pops up a UAC dialog, but because RunLegacyCPLElevated.exe is set to run those Control Panel plug-ins with full administrative privileges, the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system.

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel?

Sorry, this does not constitute a threat. Just one more indication that we need some form of licensure before letting people anywhere near a computer.



I'll gladly join in on the MS bashing - when appropriate. In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

Re:C'mon, give MS a break here! (1)

teridon (139550) | more than 7 years ago | (#18151990)

Ah, elistism at its finest.

Computers seem to be heading in the direction of becoming more like appliances; something you just use to do what you want. Why should a normal computer user know exactly what's going on behind the scenes for every action they do?

I consider myself an advanced windows user, but I'm still not sure at all times what every application and service and background process is doing. If you tell me you DO know EVERYTHING that is happening -- well you are very special. Also, why should I care? Sometimes I just want to get my work done!

Re:C'mon, give MS a break here! (4, Insightful)

stokessd (89903) | more than 7 years ago | (#18152354)

"Computers seem to be heading in the direction of becoming more like appliances; "

True, and we are in a dangerous "middle-ground" between a complex tool that only knowledgeable people use, and a true appliance that anybody uses.

The problem is that the operating system is too brittle and vulnerable to be considered an appliance. Do you ever think about how you use your toaster? If I put this new organic untrusted bread in the toaster will my toaster be taken over and corrupt the blender and waffle maker and start a kitchen rebellion? If I put in this DVD of "Ishtar" in my DVD player will it require a weekend to reinstall it's OS and useful applications?

No, that doesn't happen because appliances are robust and there isn't much a user can do to hurt them when used in their intended ways.

Now the current computers (particularly windows) are becoming appliances but haven't gotten to the critical point where they really become appliances. that transition will happen when a big chunk of the OS is hidden from the user and the user works in a Sandbox. It will be a lot less useful because it will only do what it was designed to do, but it will be safe and reliable for it's intended purpose. Then it will be an appliance.

The problem is that computers are sold as the answer to lots of the average user's non-problems. Like any good for sale in a capitalistic society, it's jammed down the throats of everybody the seller can get their hands on. So lots of people who maybe shouldn't be using computers (in their current unrestrained form) are using them (they are the ones who you get your spam from).

This is a windows problem not only because of shoddy engineering, but also because of Microsoft's position in the market. Let's look at the three major OS's:

Linux (BSD et al): It's a computer hobbiest's paradice, lots of great code, well defined heirarchy. Plus in general hard to get your hands on if you are "Joe User" who just wants to get a computer to e-mail the kids at school. This means that the people who are using this os WANT to use it for some reason (insert long list here), and they are going out of their way to use it. This means that this segment is typically very computer savvy and not likely to be pwned as a group.

Macintosh: This is also a "Harder to get" computer for two reasons. First, they are very expensive compared to the best-buy special. Second they are only sold in a few places. These two reasons make the Mac a sought-out computer rather than what the sales droid told you to buy. The average user is probably less computer savvy than the average Linux user, but in the case of the Mac, apple also "has your back" to some degree with frequent patches and a well designed core OS that minimizes your risk to begin with.

Windows: This is the default OS you get if you close your eyes and pick a computer. This means that if you have no clue about computers, chances are you get a windows box. Its fertile ground for stupid users to take advantage of (can I interest you in a free screensaver?). And in addition to that, MS has huge legacy issues that they can't change or they break business apps. MS has painted itself into this corner by selling to the lowest common denominator.

Change the borders to any color you like, there are still a huge amount of computer users that shouldn't be computer users under the current OS choices.

Re:C'mon, give MS a break here! (1, Insightful)

pla (258480) | more than 7 years ago | (#18152738)

Ah, elistism at its finest.

I know, right? Daring to think that people would bother to learn how to properly feed and care for a $500+ investment. I can act like quite the insensitive bastard some days...



Also, why should I care? Sometimes I just want to get my work done!

And I just want my car to get me to work. But if I don't know the condition of literally hundreds of seemingly-irrelevant aspects of that vehicle, it either won't continue getting me there every morning for very long, or in the worst case, won't get me there at all. From whether or not it has fuel and wiper fluid and a full compliment of working lights, to where I put the key in and which way to turn it and how far and if it wants the brake/transmission/lights/door/seatbelt in a certain state to start, to when I need my next periodic maintenance, to the countless conditions I might need to notice and evaluate while actually on the road.



I consider myself an advanced windows user, but I'm still not sure at all times what every application and service and background process is doing.

I don't need to know exactly how my transmission works, but I do need to take action if I find a pink puddle under my car.

On my machine right now, I have 38 processes running, which includes 35 services lumped into a half-dozen "svchost"s. I can't claim to know exactly how each of those 67 tasks (38+35-6) does its job, but I do know whether or not it "should" run under normal conditions.



Computers seem to be heading in the direction of becoming more like appliances

They won't ever get there, in their present form.

You may see a lot more dedicated computer-like devices, such as DVRs, email/web "appliances", and personal organizers; But the realm of general-purpose computing will always remain all but closed to those unwilling to invest the time to learn the basics. And by the basics, I mean a hell of a lot more than MSIE, Word, and Outlook.

Even beyond knowing what should run, though, even a total novice user should have the basic grasp of "I didn't just try to do anything that should require administrative access, why does it want elevated permissions?". If your microwave oven wants the PIN to your ATM card, you shouldn't need the message to appear in a different color to clue you in to the oddness of the request.



If you tell me you DO know EVERYTHING that is happening -- well you are very special.

No. Not special. Just "curious". If I open Task Manager (I actually use Sysinternals' Process Explorer, but same idea) and see something I don't recognize, I look it up. Simple as that. It doesn't take a genius or even hours of research, just Google and and a spare 30 seconds.

So yeah, if you won't invest that much time (per process) in operating an expensive machine, then you shouldn't use a computer. Or a car. Or any power-tools. Or reproduce. ESPECIALLY reproduce.

And if it makes me an "elitist", or just a plain ol' bastard, for thinking that some things in life require learning how to do them right - So it goes. But I don't get infected with spyware, so, take that as you will.

Re:C'mon, give MS a break here! (1)

sydb (176695) | more than 7 years ago | (#18153660)

No, computers are not becoming like appliances. Appliances do one thing or a small set of things well. Computers - "general purpose" computers - do whatever can be done by a Turing machine. This is the problem. A toaster does not run bread, it toasts it (I nearly said a toaster does not execute bread but that's debatable). Computers execute programs and users can't know what their computers do unless they educate themselves about how they work and the programs they run.

In the 70s and 80s you could buy dedicated word processors. They were appliances. If all your computer did was word processing, I'm sure you wouldn't be too happy, because you want to install and run new exciting programs that do new things with your machine. That ability comes at the cost of understanding what you are doing or losing control of your machine.

Re:C'mon, give MS a break here! (1)

IWantMoreSpamPlease (571972) | more than 7 years ago | (#18152512)

>>In this case, any blame rests solidly with users who have no idea what they should or shouldn't let run on their computers.

There is a problem with this, ever seen a dialog box pop up saying that such and such is attempting to run, will you allow?

This is especially the case with Norton Internet Firewall, and the such and such can often be something like mspooler.exe, which to a standard user, or total novice is utterly meaningless.

Rather than pop up and say some obscurely named app is trying run, what about a dialog that says this application trying to run is part of the OS and is recognized as such?

In other words, give a meaningful plain english question, that might just allow the user to understand what's actually transpiring, as opposed to geek speek.

Re:C'mon, give MS a break here! (1)

hxnwix (652290) | more than 7 years ago | (#18153180)

So we make fun of Homeland Security for their meaningless color-coded threat levels, but take the colored borders of confirmation dialogs on Vista as gospel
I believe that the Homeland Security system is mainly employed to incite fear in the voting public. That is why it's disparaged and believed to be useless - those of us who dislike it see it as a propoganda reinforcement apparatus.

UAC can also be seen through a cynical lense: it alerts the user to even the most trivial harmless request so that when anything of any sort goes wrong, Microsoft can plausibly say that the user permitted it.

Nonetheless, UAC using the color green to incorrectly indicate that there is not a threat is a problem just as the Homeland Security alert falsely indicating no threat is a problem.

Do you understand why?

Better listen up, guys... (5, Funny)

Donniedarkness (895066) | more than 7 years ago | (#18151732)

Better listen up; this is coming from Symantec, the guys that brought us Norton Internet Security. These guys KNOW how to really mess computers up.

Norton Joke (0)

WindozeSux (857211) | more than 7 years ago | (#18151810)

Why is Peter Norton always standing there with his arms folded?

He's waiting for Norton Desktop to load.

Re:Better listen up, guys... (1)

dr_d_19 (206418) | more than 7 years ago | (#18152282)

That's actually no joke. I haven't been able to uninstall (always "fails") from any of the computers where I've found it preinstalled. It always ends up in some half installed state generating errors at every boot and messing up Outlook.

Re:Better listen up, guys... (1)

Tim Browse (9263) | more than 7 years ago | (#18152606)

I got Norton Utilities for Windows once, as I needed to undelete some files.

After I was done, I noticed it had some Norton Desktop performance tuner stuff, which I installed out of curiosity (I wasn't expecting much, tbh).

It was a goddamn joke - it displayed a shedload of shiny dials and meters, and had all sorts of omnipresent UI crap for me to play with to 'improve' my settings and performance.

The only trouble was, the mere act of installing all this shit made my PC take twice as long to start up, and seemed to run like a dog afterwards. I uninstalled it immediately, and suddenly my PC was way faster again.

To this day, I can't work out if Symantec was just playing some sort of post-modern joke on me.

or, get it to look like spam (4, Funny)

192939495969798999 (58312) | more than 7 years ago | (#18151742)

Just get it to vibrate around like those horrible "you're the 99999th visitor!" pop-ups, and anyone would click whatever to get rid of it. Furthermore, you could change it to one of those "are you stupid?" pop-ups, that the "no" button moves around. There are a zillion ways to get someone to click the button you want.

Re:or, get it to look like spam (1)

Gr8Apes (679165) | more than 7 years ago | (#18152082)

which is one of the reasons that *nix systems are far superior to Windows. Programs don't run until their permissions indicate they can run.

I didn't think it was that difficult (0, Troll)

hackstraw (262471) | more than 7 years ago | (#18151762)


From what I understand, the UAC thing comes up all the time (even copying and pasting?!?!), so people just will ignore it and say allow all the time. Also, I read here on slashdot that UAC didn't ask anything when installing software, so there is the best backdoor already put into the OS as a design decision.

Its really sad that people believe that Windows == computers. It will take a decade for people to get over the PTSD once another system becomes available to the general public.

Re:I didn't think it was that difficult (1)

mgiuca (1040724) | more than 7 years ago | (#18152042)

Uh there have been lots of systems available to the general public for the twenty years Windows has been around. People didn't get over it.

Re:I didn't think it was that difficult (3, Informative)

SCPRedMage (838040) | more than 7 years ago | (#18152060)

UAC prompts are NOT that common, and UAC prompts when copy and pasting is a myth. Please, let it die.

Re:I didn't think it was that difficult (1)

Cro Magnon (467622) | more than 7 years ago | (#18152274)

Personally, I haven't had much trouble with UAC, and I do a lot of copy/pasting. It did come up when Firfox wanted to upgrade, but that's no surprise.

Re:I didn't think it was that difficult (1)

ferrgle (945967) | more than 7 years ago | (#18152304)

Just to add the UAC prompt does NOT come up all the time and does NOT appear when copying or pasting.
It IS damn annoying though!
I personally feel that most people won't turn it off because they won't realise that they can.
But in saying that most people won't read what it says anyway.
(The above is based on experience.)

Re:I didn't think it was that difficult (0)

Anonymous Coward | more than 7 years ago | (#18152508)

Wrong on both counts. But thanks for speaking up and letting everyone else know "what you've heard"! Very helpful!

Now, yes, you are prompted for admin access when you copy files in an area where you shouldn't be playing, like C:\Windows.

And no, you still very much so get prompted by UAC when installers run.

Mirrordot Link (1)

etwills (471396) | more than 7 years ago | (#18151804)

I got binary nonsense when I followed the link to the article.

The Mirrordot link works: http://mirrordot.org/stories/bdc4f568dcc5c7b125832 2aec4d77944/index.html [mirrordot.org]

Re:Mirrordot Link (0, Redundant)

wjsteele (255130) | more than 7 years ago | (#18151830)

Nope... that was the article... it is all nonsense!

Bill

UAC is not there for *user* protection (1, Insightful)

Theaetetus (590071) | more than 7 years ago | (#18151808)

"It's very important to remember that UAC prompts are not a security boundary -- they don't offer direct protection," said Whitehouse. "They do offer you a chance to verify an action before it happens. Once you allow an action to proceed, there may be no easy way back. So while Microsoft may use the word 'trust' in relation to UAC in some of their [other] documentation, in actual fact, even the data these UAC prompts provide you with can't be trusted."
It's pretty obvious from Microsoft's response that this is an example of Bruce Schneier's "security theater". UAC doesn't actually protect the user, but it enables Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault." (or, more likely "you were so annoyed by UAC that you turned it off, it's not our fault"
This isn't security, this is a legal CYA.

Re:UAC is not there for *user* protection (4, Insightful)

gsslay (807818) | more than 7 years ago | (#18152110)

UAC doesn't actually protect the user,


I would be interested in what you consider would protect the user. You have three options here.


1/ No-one decides what goes on your computer. It's an open free-for-all.

2/ Microsoft decides what goes on your computer. Corporate lock-down.

3/ You decide what goes on your computer. You're the boss.



We've already seen what happens with option 1. It's a security nightmare for everyone. I can imagine just how popular the second option there would be, people already have plenty to bitch about the controlling nature of Microsoft without adding to it.


So it's got to be option number 3. The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide.


Which is pretty much what is happening here. And still people complain.

Re:UAC is not there for *user* protection (1)

Cro Magnon (467622) | more than 7 years ago | (#18152306)

So it's got to be option number 3. The only other thing Microsoft can do then is to warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide.


I agree with the choice. It's the user-friendlyness that's in question.

Re:UAC is not there for *user* protection (2, Insightful)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18152702)

I would be interested in what you consider would protect the user. You have three options here. 1/ No-one decides what goes on your computer. It's an open free-for-all. 2/ Microsoft decides what goes on your computer. Corporate lock-down. 3/ You decide what goes on your computer. You're the boss.

The basic problem is the assumptions behind your classification. You assume that "something on your computer" equates to "your computer is compromised." I agree that the user needs to be the one determining what is installed an further, I agree that the OS should, "warn the user what's happening to their computer, provide as much useful information as possible (in as much a user-friendly manner as possible) and then let the user decide." You're still missing a piece of the puzzle here. The OS needs to let the user what is going on, very specifically and the OS needs to let the user allow and deny behaviors very specifically. That is how UAC fails.

Which is pretty much what is happening here. And still people complain.

The Register described UAC as "too little too late." That about sums up my opinion. It is a baby step in the right direction, but no where near enough to actually solve the problem users have and because of the implementation of certain elements may lead to long term greater insecurity because of the way it trains users.

Here's a simple example of how UAC fails and why. A user downloads a trojan installer and double clicks on it. Installers, by default, run as admin and require the user to click "Allow" in a UAC prompt. This means a trojan installer and a freeware game installer appear, to the user, to be exactly the same. Worse, the user has been asked to click "Allow" many times for other procedures where there was very little risk. What would make any reasonable security person assume the user will not click "Allow?"

My assertion is that by default the user should be allowed to install anything they want, but that all software should run in an ACL sandbox, by default, and should be restricted from certain behaviors by default and that the user should be prompted not when installing software, but when the software actually tries to do something most legitimate software does not need to do, and then they should be given well crafted dialogue boxes with unique actions for buttons to avoid conditioning.

This is entirely doable, it just requires that MS take security seriously and actually looks at the problem and the behaviors of users and creates a technological solution designed to solve that problem. UAC is a "me too" solution that tries to bring security up to par with common Linux and OS X desktops, but it ignores that those desktops are not under constant attack by malware while Windows is. Windows needs to be better than the average Linux desktop in order to provide users with the same risk of infection. UAC is nowhere near the level of security needed and the poor UI design exacerbates exisiting security problems brought on by previous poor UI designs in Windows.

Re:UAC is not there for *user* protection (1)

Theaetetus (590071) | more than 7 years ago | (#18152730)

Which is pretty much what is happening here.

Not until Microsoft ships systems with all ports closed and no services running, by default. If the user wants Remote Administration, they should be able to turn it on. It should be easy and clear how to do so, but be off at the start. Remember DCOM? That's how not to do it.
Look at OSX - all ports closed, no services running, but trivial if you want to turn them on. As a result, the Aunt Tillys never enable File Sharing accidentally, and the LeetUberUsers can happily turn on as many services as they want.

Re:UAC is not there for *user* protection (1)

mattpalmer1086 (707360) | more than 7 years ago | (#18153134)

You missed two other options that might be useful to have:

4/ Whatever goes on your computer still requires privileges to execute.
5/ Whatever executes on your computer should not require all the privileges you have (e.g. delegate a small set of them to each process instead). Does this tetris game really need low level access to the disk driver? And a network connection? etc. etc.

Re:UAC is not there for *user* protection (3, Insightful)

jb.hl.com (782137) | more than 7 years ago | (#18152454)

UAC doesn't actually protect the user, but it enables Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault."

It wouldn't be their fault. Nor should it be their fault.

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be? If you shoot yourself, are Smith and Wesson liable?

If Microsoft was held liable for the actions of third party applications, it would open up the way for lawsuits against pretty much every other OS provider that gave their customers a chance to run nasty programs on their OS. Imagine the lunacy that would result from that. Imagine the ass-covering lockdown that would most likely result. Not very nice at all...

Re:UAC is not there for *user* protection (1)

Theaetetus (590071) | more than 7 years ago | (#18152670)

Microsoft shouldn't be required to take the blame for harm that results to their installation or data because of third party programs that they themselves didn't supply. You allowed the program to run, you deal with the consequences; it isn't Microsoft's fault at all that you decided to allow NastyShitware.exe to run. Why should it be?
Microsoft should be held responsible, not for you running annakournikova.exe, but for having DCOM, Remote Administration, Messenger, etc. running by default. They are responsible for those - they could have had them off and let users turn them on if they wanted them, but they were more interested in helping out corporate IT departments than home users. As a result, their systems are secure, only when behind a corporate firewall. That's poor design.
UAC is merely an attempt to slap a "well, it's not our fault" on the design.

Re:UAC is not there for *user* protection (1)

jb.hl.com (782137) | more than 7 years ago | (#18152746)

That's quite different, and a bit of a strawman. Of course they should be held responsible for security holes which they introduced in messenger, DCOM etc; it's a different matter entirely when it comes to third party programs which they have no involvement with or approval of doing malicious or dangerous things, especially when the user explicitly allowed those things to happen. They might as well slap a "well it's not our fault" on the design, if only to make it clear that it isn't their fault if a program you installed and ran fucks something up.

(Of course this is all moot, since the EULA disclaims all responsibility and absolves Microsoft of all guilt. Nice of them.)

Re:UAC is not there for *user* protection (1)

Theaetetus (590071) | more than 7 years ago | (#18153126)

(Of course this is all moot, since the EULA disclaims all responsibility and absolves Microsoft of all guilt. Nice of them.)

Not that moot... Click-through EULAs have been held to be non-binding in a few court cases.

Re:UAC is not there for *user* protection (1)

jb.hl.com (782137) | more than 7 years ago | (#18153420)

Erm:

"Few cases have considered the validity of clickwrap licenses. However, in the cases that have challenged their validity, the terms of the contract have ultimately been upheld [wikipedia.org] [...] Essentially, under a clickwrap arrangement, potential licensees are presented with the proposed license terms and forced to expressly and unambiguously manifest either assent or rejection prior to being given access to the product."

Re:UAC is not there for *user* protection (1)

goarilla (908067) | more than 7 years ago | (#18152748)

isn't the Microsoft EULA their legal CYA ?

Re:UAC is not there for *user* protection (1)

Stormx2 (1003260) | more than 7 years ago | (#18153858)

Microsoft, in response to any virus/worm/trojan/botnet/class action lawsuit to say "well, you clicked allow. It wasn't our fault."


Thats like saying "Well you were the one who pressed the on button! We can't be held responsible for that!"

If you click on green, you get the blue (-1, Flamebait)

Kazymyr (190114) | more than 7 years ago | (#18151978)

(as in: screen of death), or whatever color that is in Vista these days. :)

Anti-Virus makers, make Virus.... same old scare (4, Insightful)

Jackie_Chan_Fan (730745) | more than 7 years ago | (#18152018)

These guys are pointing this out, because they want to sell symantec products. Thats the only reason why this article came out. It's the only reason why Symantec released this statement. They want to put the message out there that "You're not secure without Norton"

This is a corporate propaganda directive, possibly directly from the CEO him/herself. "Find something, and lets use it to make us money"

The old anti virus company making viruses, just to fuel sales... has come true. They dont have to release the viruses though, but simply they figured something out, and to tell the world that something.

Profit at all costs.

Re:Anti-Virus makers, make Virus.... same old scar (1)

MagicBox (576175) | more than 7 years ago | (#18152172)

Sad scene. Symantect sinks to an all time low, after years of destroying countless Windows PCs and frustrating millions, all while being ineffective in detecting and removing viruses, but very effective in detecting and removing Windows kernel after flagging it as a deadly virus in your PC. The asking the user to REBOOT

Re:Anti-Virus makers, make Virus.... same old scar (2, Funny)

Knux (990961) | more than 7 years ago | (#18152334)

Actually, I feel quite secure with my XP SP2 behind a well configured router, without any anti-virus. I don't think I've got any viruses on it, but if I do, it doesn't feel as slow as a computer running Norton.

Re:Anti-Virus makers, make Virus.... same old scar (1)

game kid (805301) | more than 7 years ago | (#18152978)

These are the same guys that sell Mac OS antivirus through fear [slashdot.org] and can never have enough access [informationweek.com] to the Vista kernel.

Microsoft has some big problems with security, but Symantec is sickeningly desperate. I used to depend on Norton/Symantec to keep my computer from dying. Now I just want the company to die (as desperate companies sometimes do). They sound like one big Mad Money "sell-sell-sell" button, just wanting to sell something to the public for whatever they use.

But, What Now? (1)

nwoolls (520606) | more than 7 years ago | (#18152602)

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?

Re:But, What Now? (1, Insightful)

99BottlesOfBeerInMyF (813746) | more than 7 years ago | (#18152776)

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?

Well, one obvious answer is to provide fake UAC authorization prompt for dozens upon dozens of applications and hide the real UAC prompt in the middle of them. After six or seven the average user will just start hitting "Allow" for everything under the assumption that they need to to get their OS to work again, or they will turn of UAC entirely.

Re:But, What Now? (1)

Knux (990961) | more than 7 years ago | (#18153058)

After six or seven the average user will just start hitting "Allow" for everything MS response: "We warned the user, it's his fault"

Re:But, What Now? (2, Informative)

Coward the Anonymous (584745) | more than 7 years ago | (#18153064)

Ok. Time for a question. So you've programmed a screen to mimic UAC. Good job. Now, to do any damage, your app must request elevation from Vista. Uh oh, guess what. Time for a REAL UAC prompt. Now what?


If you read the article, you would have seen that they are not mimicing the UAC screen but actually causing Vista to prompt the user a real UAC dialog that grants Admin priveledges.

From the Article:

Finally, the malicious code would call the "RunLegacyCPLElevated.exe" -- the Vista executable that provides backward compatibility to older Windows Control Panel plug-ins -- which in turn runs the .dll. That pops up a UAC dialog, but because RunLegacyCPLElevated.exe is set to run those Control Panel plug-ins with full administrative privileges, the dialog is bordered by Vista's own greenish color to signify the file is part of the operating system. As soon as the user clicks the "Confirm" button, the malicious code is granted administrative privileges, giving the code -- and thus the attacker -- full access to and complete control of the machine.

UAC? (0)

Anonymous Coward | more than 7 years ago | (#18153220)

Am I the only one who sees UAC and thinks "Union Aerospace Corporation".
Too much gaming and not enough Windows I guess.....

Old Unix security issue (1)

l2718 (514756) | more than 7 years ago | (#18153278)

Hey -- this is simply a setuid root shell, a potential security hole as old as Unix. Apparently programmers never learn from experience. When I administer a system, a program which runs other programs based on user input doesn't get to be setuid root.

Why not just pop up a fake UAC box? (0)

Anonymous Coward | more than 7 years ago | (#18153354)

The big issue I see with both the KDE/Gnome/Windows popup boxes is that you regularly click on software and it says something like "This operation requires admin permissions, please enter your password" - at which point the user enters the password into the next box which appears. ...So simply code a box which *looks* like the system popup and capture the users password... OK, perhaps windows pops up some additional boxes subsequently, but I doubt that's a major barrier and I would suspect even a completely different style of popup box asking for a password (to the normal system one), would still fool about 30%+ of computer users...

Seems like a really simple way to blow open this whole silly "click to authenticate" thing...?

I am colourblind (3, Informative)

Kimos (859729) | more than 7 years ago | (#18153390)

I don't use Vista so I don't fully understand. Do the colours of the popups provide security-related information? Seems pretty ridiculous and unfair, considering I'm not the only person in the world who is colourblind...

Isn't this the whole point of UAC? (1)

DavidD_CA (750156) | more than 7 years ago | (#18153414)

So basically Symantec is saying:
    1) Sneak in a file with a virus payload
    2) Execute that file, triggering the UAC
    3) User blindly clicks "OK"

Of course, the point of UAC is to prompt the user when something is trying to run that requires admin privledges. Users know that when they see this box randomly pop up that something unusual is happening.

Unless they just said to install some software or tried to change a setting themselves, seeing this pop up when they visit MySpace or something shouldn't be a problem.

UAC is meant to provide users with an alert saying "something bad may be happening, stop it?" It's not meant to completely lock down your computer to the point where you have to log off and back on as an admin to do anything.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>