3 ms·

I assume this didn't get as high a level of scrutiny because it still fundamentally requires you admin-elevate the running of code from a questionable source. S

I assume this didn't get as high a level of scrutiny because it still fundamentally requires you admin-elevate the running of code from a questionable source. Sure a bad driver might claim it's from Dell, but it wasn't one you downloaded from dell.com so you probably shouldn't be trusting it. Raymond Chen has largely pointed out the position of Microsoft that if you authorize code to run with elevated permissions and it does things it can do with elevated permissions, it's not really a security flaw.

deleted 4y ago
[deleted]
PeterisP 4y ago
Such drivers may enable local attacks like the Razer driver issue (one description at https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...) since plugging in a particular device (or, really, a cheap USB chip that will fake the proper device IDs) can automatically download & install the vulnerable driver.
- ocdtrekkie 4y ago
  This isn't really true: Because it'll download the driver from Windows Update, so it'll serve the latest version. Obviously after the zero day is dealt with that will no longer happen. This is about a flaw that lets someone with admin rights install an old driver which has already been replaced/fixed on Windows Update.
Genbox 4y ago
I largely concur with Raymond Chen's reasoning on the subject. However, there are two distinct factors Microsoft does not seem to realize as problems: 1. There has been a precedent in Windows to run everything as local administrator. Linux has always had the user vs. root paradigm, but Windows - at least in the client versions - has always just defaulted to administrative accounts. 2. Features designed to provide more fine-grained control of token privileges, such as UAC, process integrity, and virtualization, have been excluded from security bug bounties as being "not a real security boundary". This stance is somewhat counterintuitive and quite dangerous. Combine those two with the fact that Microsoft never provided sane secure defaults for any of their software; it just goes to show that Microsoft is not concerned nor bothered with securing their software. That shifts the issue of "don't run as admin, stupid" responsibility from the user to Microsoft to a large extent.
- ocdtrekkie 4y ago
  I think the core issue is Windows has always prioritized consumer usability, and that often, yes, means worse security defaults. I only finally stopped being an admin on my personal PC's main account a couple months ago, and I consider myself a security person. ;)
stjohnswarts 4y ago
Did I miss something? If you have something that -should- have a non-reversable hash indicating that it is signed should that not work in all cases? I mean I don't see how anyone could argue that is "ok" even as an admin. At the very least it should throw up a warning and say "this driver is signed but it's not jiving with what is supposed to be there and likely malware so you shouldn't install it or know exactly what you are installing"
- ocdtrekkie 4y ago
  I mean the point is for this feature to help you, you have to A. be an admin running an install elevated and B. be installing something from a less than reputable source. In this scenario, the ways to compromise your system are already numerous. Yeah it's bad Microsoft built a feature to try to help you in this scenario and it wasn't working, but it's also just one of many many ways to screw you at this point.

deleted 4y ago

[deleted]

PeterisP 4y ago

Such drivers may enable local attacks like the Razer driver issue (one description at https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...) since plugging in a particular device (or, really, a cheap USB chip that will fake the proper device IDs) can automatically download & install the vulnerable driver.

ocdtrekkie 4y ago
This isn't really true: Because it'll download the driver from Windows Update, so it'll serve the latest version. Obviously after the zero day is dealt with that will no longer happen. This is about a flaw that lets someone with admin rights install an old driver which has already been replaced/fixed on Windows Update.

Genbox 4y ago

I largely concur with Raymond Chen's reasoning on the subject. However, there are two distinct factors Microsoft does not seem to realize as problems: 1. There has been a precedent in Windows to run everything as local administrator. Linux has always had the user vs. root paradigm, but Windows - at least in the client versions - has always just defaulted to administrative accounts. 2. Features designed to provide more fine-grained control of token privileges, such as UAC, process integrity, and virtualization, have been excluded from security bug bounties as being "not a real security boundary". This stance is somewhat counterintuitive and quite dangerous. Combine those two with the fact that Microsoft never provided sane secure defaults for any of their software; it just goes to show that Microsoft is not concerned nor bothered with securing their software. That shifts the issue of "don't run as admin, stupid" responsibility from the user to Microsoft to a large extent.

ocdtrekkie 4y ago
I think the core issue is Windows has always prioritized consumer usability, and that often, yes, means worse security defaults. I only finally stopped being an admin on my personal PC's main account a couple months ago, and I consider myself a security person. ;)

stjohnswarts 4y ago

Did I miss something? If you have something that -should- have a non-reversable hash indicating that it is signed should that not work in all cases? I mean I don't see how anyone could argue that is "ok" even as an admin. At the very least it should throw up a warning and say "this driver is signed but it's not jiving with what is supposed to be there and likely malware so you shouldn't install it or know exactly what you are installing"

ocdtrekkie 4y ago
I mean the point is for this feature to help you, you have to A. be an admin running an install elevated and B. be installing something from a less than reputable source. In this scenario, the ways to compromise your system are already numerous. Yeah it's bad Microsoft built a feature to try to help you in this scenario and it wasn't working, but it's also just one of many many ways to screw you at this point.