5 ms·

From my experience, it's that users are administrators by default. And it is super easy to convince them, to run anything with elevated permissions.

ajross 2y ago
The exploit under discussion is an attack on Windows Update, it doesn't AFAICT involved running privileged code as the user. Also the default Windows user has been non-Administrator for many years now. It's true you can fool users into elevating a shell or whatever, but that's true for pretty much all platforms.
- ethbr1 2y ago
  I'm happy to complain about Windows, but I will say their progress in converting their ecosystem to user-by-default with elevation prompt warnings has been impressive. Especially when they had to drag their developer community kicking and screaming to it. (in Windows Vista ~2006) Afaicr, there's also a neat bit where the lock screen and UAC prompt actually run under an entirely different, privileged and restricted session (than the normal one the user is interacting with and running programs in). Ref: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#securing-the-elevation-prompt https://learn.microsoft.com/en-us/windows/security/applicati... Apparently now termed the "secure desktop", it's transparently overlaid on top of the user desktop whenever you see a prompt.
  - dimensi0nal 2y ago
    It's not a transparent overlay, it's a completely separate desktop with a screenshot of the user desktop as its background. Really clever.
    - wongogue 2y ago
      And 50% of the times, the background fails to load and I have to double check. At first I thought it may be my specfic hardware combo but no.
    - magicalhippo 2y ago
      And that the desktops are securable objects[1], so processes in the default desktop can't snoop on what's going on in the winlogon desktop say when the UAC prompt is shown. [1]: https://learn.microsoft.com/en-us/windows/win32/winstation/desktops https://learn.microsoft.com/en-us/windows/win32/winstation/d...
SoftTalker 2y ago
As if most linux users aren't also in the sudo group?
- graemep 2y ago
  There are multiple ways to set things up in Linux. You can use sudo, or you can have a separate root user. I have not used Windows enough in recent years to know, but there may be differences in what you need to enter your admin password for, which may make users less suspicious when asked. On Linux distros I have used the only regular operation on a desktop that requires it are software installation and updates updates, which has a well defined UI and comes after a specific user action.
  - gruez 2y ago
    >but there may be differences in what you need to enter your admin password for, which may make users less suspicious when asked. On Linux distros I have used the only regular operation on a desktop that requires it are software installation and updates updates, which has a well defined UI and comes after a specific user action. clearly you haven't seen all the projects on github where the instructions are "curl ... | sudo sh". Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure. [1] tl;dr: modify $PATH to contain a bobbytrapped version of sudo that executes the command you want, plus whatever evil stuff you want.
    - mycall 2y ago
      Reserve shells are indeed simple in *nix
    - graemep 2y ago
      > learly you haven't seen all the projects on github where the instructions are "curl ... | sudo sh". I have seen them. I do not use them! I very rarely install anything from outside distro repos or language repos. > Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure. You have missed my point. You do not have to use sudo
card_zero 2y ago
Is that different from sudo?
- NekkoDroid 2y ago
  Well, the main difference is that one you just click "yes" and the other you usually need to enter a password. Then there is also polkit, which does something similar to sudo, but for a different usecase (authenticating unpriviledged process access to a priviledge process). Polkit to my knowledge can differentiate between actions to "always allow", "requires confirmation" (press yes) and "require password".
  - admax88qqq 2y ago
    The main difference is that UAC is automatically triggered by the OS and takes over the whole display making it harder to fake/intercept. It’s trivial to put a fake sudo in someones PATH and steal their password
    - survivedurcode 2y ago
      lol UAC is such a lazy shitshow of a security implementation… A) there is no interception to be had. It’s a fucking “Yes I am Admin” single click a child could do unsupervised. B) It requires training for the user to know that this is a special UAC mode. That’s high-motivation, high-knowledge user training. Pilots train to recognize unusual signs. Your grandma does not train to recognize what UAC looks like, why it would come up and when. UAC is the biggest cop out of a security excuse and Windows should be ashamed.
      - admax88qqq 2y ago
        Sure I guess, I don't know why UAC gets so much hate while sudo gets so much praise. UAC is strictly better than sudo IMO. Does UAC solve security for windows? Of course not, but we were comparing against sudo here.
      - ruthmarx 2y ago
rockskon 2y ago
The alternative to that is Android and IOS where we don't have full control over our own devices unless we jailbreak them, which itself breaks so many critical apps on the mobile device stores that it's frequently not worth it to root the device. No - the problem here is moreso the sheer complexity of Windows and the variety of devs involved and the push for backwards compatibility.
advael 2y ago
It'd be a lot less easy if the OS didn't seem to require full privilege escalation for a lot of tasks you don't need that for in linux. One of the major problems that leads to escalation is poor separation of concerns
- tredre3 2y ago
  What action requires admin escalation on Windows but not on Linux?
  - advael 2y ago
    Just counting things I've personally seen, using "untrusted" userspace software and accessing a USB webcam. It's possible these particular examples are no longer true. I haven't been a windows user for about 15 years. But both surprised me quite a lot when I saw people I know do them and it seemed indicative of a systemic separation of concerns problem
    - joshuaissac 2y ago
      > using "untrusted" userspace software and accessing a USB webcam Windows only requires escalation for this if you want to install that userspace software to a non-user location,* or if you want to install a driver for the webcam. If you just want to run the program, this is not required. A long time ago, in the pre-Vista era, when running programs as administrator was the default, many programs would not work if they were not run as administrator. This is no longer case for programs written after Vista. From Vista onwards, older programs that assume admin rights and attempt to change admin-only files get their reads and writes redirected to a VirtualStore folder within the user's profile, so that the program still works without administrative permissions. * The exception is with some installers where the UAC installer detection kicks in and demands escalation straight away, even before you select an installation location (which could be a user-writable location). Turning this off requires using the Group Policy Editor or the Registry Editor to flip the EnableInstallerDetection registry key.

ajross 2y ago

The exploit under discussion is an attack on Windows Update, it doesn't AFAICT involved running privileged code as the user. Also the default Windows user has been non-Administrator for many years now. It's true you can fool users into elevating a shell or whatever, but that's true for pretty much all platforms.

ethbr1 2y ago
I'm happy to complain about Windows, but I will say their progress in converting their ecosystem to user-by-default with elevation prompt warnings has been impressive. Especially when they had to drag their developer community kicking and screaming to it. (in Windows Vista ~2006) Afaicr, there's also a neat bit where the lock screen and UAC prompt actually run under an entirely different, privileged and restricted session (than the normal one the user is interacting with and running programs in). Ref: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/user-account-control/how-it-works#securing-the-elevation-prompt https://learn.microsoft.com/en-us/windows/security/applicati... Apparently now termed the "secure desktop", it's transparently overlaid on top of the user desktop whenever you see a prompt.
- dimensi0nal 2y ago
  It's not a transparent overlay, it's a completely separate desktop with a screenshot of the user desktop as its background. Really clever.
  - wongogue 2y ago
    And 50% of the times, the background fails to load and I have to double check. At first I thought it may be my specfic hardware combo but no.
  - magicalhippo 2y ago
    And that the desktops are securable objects[1], so processes in the default desktop can't snoop on what's going on in the winlogon desktop say when the UAC prompt is shown. [1]: https://learn.microsoft.com/en-us/windows/win32/winstation/desktops https://learn.microsoft.com/en-us/windows/win32/winstation/d...

SoftTalker 2y ago

As if most linux users aren't also in the sudo group?

graemep 2y ago
There are multiple ways to set things up in Linux. You can use sudo, or you can have a separate root user. I have not used Windows enough in recent years to know, but there may be differences in what you need to enter your admin password for, which may make users less suspicious when asked. On Linux distros I have used the only regular operation on a desktop that requires it are software installation and updates updates, which has a well defined UI and comes after a specific user action.
- gruez 2y ago
  >but there may be differences in what you need to enter your admin password for, which may make users less suspicious when asked. On Linux distros I have used the only regular operation on a desktop that requires it are software installation and updates updates, which has a well defined UI and comes after a specific user action. clearly you haven't seen all the projects on github where the instructions are "curl ... | sudo sh". Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure. [1] tl;dr: modify $PATH to contain a bobbytrapped version of sudo that executes the command you want, plus whatever evil stuff you want.
  - mycall 2y ago
    Reserve shells are indeed simple in *nix
  - graemep 2y ago
    > learly you haven't seen all the projects on github where the instructions are "curl ... | sudo sh". I have seen them. I do not use them! I very rarely install anything from outside distro repos or language repos. > Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure. You have missed my point. You do not have to use sudo

card_zero 2y ago

Is that different from sudo?

NekkoDroid 2y ago
Well, the main difference is that one you just click "yes" and the other you usually need to enter a password. Then there is also polkit, which does something similar to sudo, but for a different usecase (authenticating unpriviledged process access to a priviledge process). Polkit to my knowledge can differentiate between actions to "always allow", "requires confirmation" (press yes) and "require password".
- admax88qqq 2y ago
  The main difference is that UAC is automatically triggered by the OS and takes over the whole display making it harder to fake/intercept. It’s trivial to put a fake sudo in someones PATH and steal their password
  - survivedurcode 2y ago
    lol UAC is such a lazy shitshow of a security implementation… A) there is no interception to be had. It’s a fucking “Yes I am Admin” single click a child could do unsupervised. B) It requires training for the user to know that this is a special UAC mode. That’s high-motivation, high-knowledge user training. Pilots train to recognize unusual signs. Your grandma does not train to recognize what UAC looks like, why it would come up and when. UAC is the biggest cop out of a security excuse and Windows should be ashamed.
    - admax88qqq 2y ago
      Sure I guess, I don't know why UAC gets so much hate while sudo gets so much praise. UAC is strictly better than sudo IMO. Does UAC solve security for windows? Of course not, but we were comparing against sudo here.
    - ruthmarx 2y ago

rockskon 2y ago

The alternative to that is Android and IOS where we don't have full control over our own devices unless we jailbreak them, which itself breaks so many critical apps on the mobile device stores that it's frequently not worth it to root the device. No - the problem here is moreso the sheer complexity of Windows and the variety of devs involved and the push for backwards compatibility.

advael 2y ago

It'd be a lot less easy if the OS didn't seem to require full privilege escalation for a lot of tasks you don't need that for in linux. One of the major problems that leads to escalation is poor separation of concerns

tredre3 2y ago
What action requires admin escalation on Windows but not on Linux?
- advael 2y ago
  Just counting things I've personally seen, using "untrusted" userspace software and accessing a USB webcam. It's possible these particular examples are no longer true. I haven't been a windows user for about 15 years. But both surprised me quite a lot when I saw people I know do them and it seemed indicative of a systemic separation of concerns problem
  - joshuaissac 2y ago
    > using "untrusted" userspace software and accessing a USB webcam Windows only requires escalation for this if you want to install that userspace software to a non-user location,* or if you want to install a driver for the webcam. If you just want to run the program, this is not required. A long time ago, in the pre-Vista era, when running programs as administrator was the default, many programs would not work if they were not run as administrator. This is no longer case for programs written after Vista. From Vista onwards, older programs that assume admin rights and attempt to change admin-only files get their reads and writes redirected to a VirtualStore folder within the user's profile, so that the program still works without administrative permissions. * The exception is with some installers where the UAC installer detection kicks in and demands escalation straight away, even before you select an installation location (which could be a user-writable location). Turning this off requires using the Group Policy Editor or the Registry Editor to flip the EnableInstallerDetection registry key.