4 ms·

> the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing) No FOSS desktop is even close to offerin

> the window should be able to use some restricted window manager feature (like Windows' fullscreen greying out thing) No FOSS desktop is even close to offering this. The windows 'greying out thing' is an entirely separate desktop instance, for example. A lot of security consideration was put into designing it. I don't think any FOSS desktop is working on anything even remotely similar, which is a shame.

vbezhenar 3y ago
What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either. The only true security feature I remember was implemented in Windows many years ago. After you got security prompt, you would need to press Ctrl+Alt+Delete and type password there. Supposedly only Windows itself could handle that combination.
- DEADMINCE 3y ago
  > What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either. Because you would be able to alt+tab to other tasks, and that application would be able to still execute code as it was able to before. It's not any kind of security 'behind the scenes'. > The only true security feature I remember was implemented in Windows many years ago. Or perhaps you didn't realize all the engineering that was taking place behind just what you see. This[0] blog post gives a good overview of some of the security architecture that went into making that elevation prompt. Honestly, MS has been leading the pack in OS security for some time. They are leagues ahead of MacOS and Linux. [0] https://learn.microsoft.com/en-us/archive/blogs/uac/user-account-control-prompts-on-the-secure-desktop https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...
  - vbezhenar 3y ago
    Why would I do "alt-tab"? Do you think users typically type alt-tab when asked for admin permissions? I never did that. It's all security theater.
    - DEADMINCE 3y ago
      It isn't security theater at all. Did you read the link? You wouldn't be able to switch to another application is the point. What you suggest greying out, would easily allow other applications to hijack that prompt or replace it with their own. That's a large part of what 'Secure Desktop' aims to prevent, and it succeeds at doing so.
      - asimops 3y ago
        That's not the point they were trying to make. They were asking what would prevent malware from imitating the UAC prompt to steal administrator privileges.
        DEADMINCE 3y ago
        I understand and answered that. The answer is Secure Desktop, details on which can be found in the link I posted in my earlier comment.
        Scion9066 3y ago
        https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works https://learn.microsoft.com/en-us/windows/security/applicati... > If the policy setting is set to Prompt for credentials, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. So just knowing the credentials is not enough, they have to be used in the right context (the secure desktop).
- asimops 3y ago
  Nothing will prevent that. The question is, what would you do with the stolen credentials in terms of privilege escalation? Suppose we are in a situation where the UAC is on and asks for every action on the secure desktop. Even if you were to authenticate with the stolen credentials, you would end up in an unprivileged session due to UAC's token filtering mechanisms. If you were then to request elevation, the UAC would prompt the user on the secure desktop, which you cannot control from within the user session. It is therefore not enough to imitate the prompt. You also need to convince the user to accept the real prompt.
- aseipp 3y ago
  If you write a piece of malware that spoofs the secure desktop prompt, then you can steal the users password or whatever. But that does not grant you higher privileges. Only the secure desktop can grant your process higher privileges. The password only authenticates you. It does not authorize you. So now your malware tries to use the credentials it stole to perform a restricted task afterword, but it will not have the proper privileges (elevated security token), so the user will get forced into the UAC prompt on the Secure Desktop. You cannot stop this from happening once you attempt to do it. The exact scenario you are describing, spoofing the secure desktop prompt, was literally the basics of the UAC prompt thought up over 15 years ago. It's like the 101 example. In contrast, on Linux, if you put a shell script in the users $PATH called 'sudo' that simply captures their password, you can (assuming the default PAM configuration) immediately use that to elevate privileges anytime you want with absolutely no intervention whatsoever. Because the password not only authenticates you, it authorizes you as well.

vbezhenar 3y ago

What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either. The only true security feature I remember was implemented in Windows many years ago. After you got security prompt, you would need to press Ctrl+Alt+Delete and type password there. Supposedly only Windows itself could handle that combination.

DEADMINCE 3y ago
> What prevents any random Windows application to make a screenshot and apply "greying out" filter to it? I mean, I launch a game and it puts full-screen image of whatever it wants. It doesn't take any special permissions to make a screenshot either. Because you would be able to alt+tab to other tasks, and that application would be able to still execute code as it was able to before. It's not any kind of security 'behind the scenes'. > The only true security feature I remember was implemented in Windows many years ago. Or perhaps you didn't realize all the engineering that was taking place behind just what you see. This[0] blog post gives a good overview of some of the security architecture that went into making that elevation prompt. Honestly, MS has been leading the pack in OS security for some time. They are leagues ahead of MacOS and Linux. [0] https://learn.microsoft.com/en-us/archive/blogs/uac/user-account-control-prompts-on-the-secure-desktop https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...
- vbezhenar 3y ago
  Why would I do "alt-tab"? Do you think users typically type alt-tab when asked for admin permissions? I never did that. It's all security theater.
  - DEADMINCE 3y ago
    It isn't security theater at all. Did you read the link? You wouldn't be able to switch to another application is the point. What you suggest greying out, would easily allow other applications to hijack that prompt or replace it with their own. That's a large part of what 'Secure Desktop' aims to prevent, and it succeeds at doing so.
    - asimops 3y ago
      That's not the point they were trying to make. They were asking what would prevent malware from imitating the UAC prompt to steal administrator privileges.
      - DEADMINCE 3y ago
        I understand and answered that. The answer is Secure Desktop, details on which can be found in the link I posted in my earlier comment.
      - Scion9066 3y ago
        https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works https://learn.microsoft.com/en-us/windows/security/applicati... > If the policy setting is set to Prompt for credentials, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. So just knowing the credentials is not enough, they have to be used in the right context (the secure desktop).
asimops 3y ago
Nothing will prevent that. The question is, what would you do with the stolen credentials in terms of privilege escalation? Suppose we are in a situation where the UAC is on and asks for every action on the secure desktop. Even if you were to authenticate with the stolen credentials, you would end up in an unprivileged session due to UAC's token filtering mechanisms. If you were then to request elevation, the UAC would prompt the user on the secure desktop, which you cannot control from within the user session. It is therefore not enough to imitate the prompt. You also need to convince the user to accept the real prompt.
aseipp 3y ago
If you write a piece of malware that spoofs the secure desktop prompt, then you can steal the users password or whatever. But that does not grant you higher privileges. Only the secure desktop can grant your process higher privileges. The password only authenticates you. It does not authorize you. So now your malware tries to use the credentials it stole to perform a restricted task afterword, but it will not have the proper privileges (elevated security token), so the user will get forced into the UAC prompt on the Secure Desktop. You cannot stop this from happening once you attempt to do it. The exact scenario you are describing, spoofing the secure desktop prompt, was literally the basics of the UAC prompt thought up over 15 years ago. It's like the 101 example. In contrast, on Linux, if you put a shell script in the users $PATH called 'sudo' that simply captures their password, you can (assuming the default PAM configuration) immediately use that to elevate privileges anytime you want with absolutely no intervention whatsoever. Because the password not only authenticates you, it authorizes you as well.