5 ms·

Why does anyone run an operating system that grants ambient authority to executables? This is analogous to a power grid stripped of all fuses and circuit break

Why does anyone run an operating system that grants ambient authority to executables? This is analogous to a power grid stripped of all fuses and circuit breakers to make it easier to design toasters. We've studied this problem since 1972[1]. Solutions were found (but the Internet Archive is down, so I can't be sure [2] points to the right files now). [1] https://csrc.nist.rip/publications/history/ande72.pdf https://csrc.nist.rip/publications/history/ande72.pdf [2] https://web.archive.org/web/20120919111301/http://www.albany.edu/acc/courses/ia/classics/belllapadula1.pdf https://web.archive.org/web/20120919111301/http://www.albany...

forgot-im-old 2y ago
It used to be you could put a file called autoplay on a USB drive and it would get executed on insertion.
- vifon 2y ago
  AFAIK it only worked with optical drives, not pendrives. I've spent hours trying to get this functionality on my pendrives back in the day, to no avail (thankfully!). It was on Windows XP, and Windows 98 needed external drivers to even use pendrives at all, so if such an attack vector existed, it must have been on Windows 2000 or Me (i.e between XP and 98), so an arguably very short time frame (if at all!).
  - actionfromafar 2y ago
    You could/can have the USB device appear as a CDROM
  - JD557 2y ago
    I recall Disk Knight (https://www.lucadamico.dev/papers/malware_analysis/DiskKnight.pdf https://www.lucadamico.dev/papers/malware_analysis/DiskKnigh...) working on Windows XP I don't remember the whole details, but I believe it installed an autorun.inf file on all USB drives so that inserting the drive on another PC would install it automatically.
sedatk 2y ago
People had drawn and quartered Microsoft because of simple access elevation prompts (UAC) in Vista, let alone a granular permissions system. It had to be dumbed down significantly over the years to be widely accepted. People have been doing the same for Apple when it tried to bring explicit app permissions to MacOS. https://tidbits.com/2024/08/12/macos-15-sequoias-excessive-permissions-prompts-will-hurt-security/ https://tidbits.com/2024/08/12/macos-15-sequoias-excessive-p...
- ferbivore 2y ago
  What Apple are doing is significantly worse than UAC.
  - Gigachad 2y ago
    What Apple is doing is significantly better. Instead of a single popup that grants access to everything and shows before the app even opens. You can granularly accept or deny individual access to things. And the program keeps working when you decline.
    - avidphantasm 2y ago
      Yeah, it’s annoying, but it’s the right thing in this day and age. Condoms are annoying too, but often necessary.
    - ferbivore 2y ago
      Okay, but permission prompts as such are not why people complained. Sure, of course you don't want apps to record your screen without permission. The problem is Apple has taken away your right to even grant this permission, for more than a week, unless they also consent (and extract a fee from the app developer). It's part of their ongoing frog-boiling campaign to remove users' freedom to run arbitrary software on Macs; this is what people object to. You can make an argument that UAC was part of a similar strategy, but not paying for an EV certificate only results in a one-time annoyance for your users, not a continuous one. UAC is equivalent to Gatekeeper. This permissions nonsense is worse than UAC.
kolinko 2y ago
I would imagine these tools use exploits in the existing executables to deliver the payload, and then - if I understand correctly, use scripting/interpreted languages (Python) to run the operation. So, even if you’d need admin confirmation to run each new binary, it wouldn’t help - because no new binaries are executed, just python with a new set of scripts. And, correct me if I’m wrong, but preventing os from running new scripts would be virtually impossible.

forgot-im-old 2y ago

It used to be you could put a file called autoplay on a USB drive and it would get executed on insertion.

vifon 2y ago
AFAIK it only worked with optical drives, not pendrives. I've spent hours trying to get this functionality on my pendrives back in the day, to no avail (thankfully!). It was on Windows XP, and Windows 98 needed external drivers to even use pendrives at all, so if such an attack vector existed, it must have been on Windows 2000 or Me (i.e between XP and 98), so an arguably very short time frame (if at all!).
- actionfromafar 2y ago
  You could/can have the USB device appear as a CDROM
- JD557 2y ago
  I recall Disk Knight (https://www.lucadamico.dev/papers/malware_analysis/DiskKnight.pdf https://www.lucadamico.dev/papers/malware_analysis/DiskKnigh...) working on Windows XP I don't remember the whole details, but I believe it installed an autorun.inf file on all USB drives so that inserting the drive on another PC would install it automatically.

sedatk 2y ago

People had drawn and quartered Microsoft because of simple access elevation prompts (UAC) in Vista, let alone a granular permissions system. It had to be dumbed down significantly over the years to be widely accepted. People have been doing the same for Apple when it tried to bring explicit app permissions to MacOS. https://tidbits.com/2024/08/12/macos-15-sequoias-excessive-permissions-prompts-will-hurt-security/ https://tidbits.com/2024/08/12/macos-15-sequoias-excessive-p...

ferbivore 2y ago
What Apple are doing is significantly worse than UAC.
- Gigachad 2y ago
  What Apple is doing is significantly better. Instead of a single popup that grants access to everything and shows before the app even opens. You can granularly accept or deny individual access to things. And the program keeps working when you decline.
  - avidphantasm 2y ago
    Yeah, it’s annoying, but it’s the right thing in this day and age. Condoms are annoying too, but often necessary.
  - ferbivore 2y ago
    Okay, but permission prompts as such are not why people complained. Sure, of course you don't want apps to record your screen without permission. The problem is Apple has taken away your right to even grant this permission, for more than a week, unless they also consent (and extract a fee from the app developer). It's part of their ongoing frog-boiling campaign to remove users' freedom to run arbitrary software on Macs; this is what people object to. You can make an argument that UAC was part of a similar strategy, but not paying for an EV certificate only results in a one-time annoyance for your users, not a continuous one. UAC is equivalent to Gatekeeper. This permissions nonsense is worse than UAC.

kolinko 2y ago

I would imagine these tools use exploits in the existing executables to deliver the payload, and then - if I understand correctly, use scripting/interpreted languages (Python) to run the operation. So, even if you’d need admin confirmation to run each new binary, it wouldn’t help - because no new binaries are executed, just python with a new set of scripts. And, correct me if I’m wrong, but preventing os from running new scripts would be virtually impossible.