"Very Severe Hole" In Vista UAC Design

"Very Severe Hole" In Vista UAC Design 813

Posted by kdawson on Tuesday February 13, 2007 @05:07PM from the she-said-he-said dept.

Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."

"Very Severe Hole" In Vista UAC Design

This discussion has been archived. No new comments can be posted.

Search 813 Comments Log In/Create an Account

Comments Filter:

Another approach. (Score:5, Funny)

by Lethyos ( 408045 ) writes: on Tuesday February 13, 2007 @05:11PM (#18003118) Journal

Why not just let the user copy the application bundle to wherever they have write permissions? That application then executes with the privileges of the user that invokes it. If only there was a platform that offered such a simple an effective solution.

Re:An even bigger hole... (Score:5, Funny)

by dotpavan ( 829804 ) writes: on Tuesday February 13, 2007 @05:13PM (#18003166) Homepage

offtopic, yet:
no doubt, thats why Dell is marketing its harware for Vista as great for "booting the OS, w/o running apps or games [googlepages.com]" (link via this [dell.com])
Since when did booting an OS become a "feature" of the OS?

Steve is that you? (Score:5, Funny)

by tiltowait ( 306189 ) writes: on Tuesday February 13, 2007 @05:16PM (#18003232) Homepage Journal

Video version of the above commentary here [apple.com].

Balancing Security with Ease of use (Score:5, Funny)

by ThatsNotFunny ( 775189 ) writes: on Tuesday February 13, 2007 @05:16PM (#18003238)

Looks like "Ease of Use" is the morbidly obese 10-year-old kid on this see-saw, and "Security" is up in the air with her legs dangling, and all the kids are lookin' up her skirt.

Re:An even bigger hole... (Score:5, Funny)

by nuzak ( 959558 ) writes: on Tuesday February 13, 2007 @05:17PM (#18003242) Journal

You want to run an application, is that okay? You want to copy a file, is that okay? You want to change your desktop background, is that okay? You want to copy text from IE7, is that okay? You want to turn your machine into a child porn and warez server, is that okay? You want to delete an old text file, is that okay? You want to paste text into a form field in IE7, is that okay?

One of these things is not like the others,
One of these things just doesn't belong,
Can you tell which thing is not like the others
By the time I finish my song?

DOOM: History repeats itself (Score:5, Funny)

by MarkGriz ( 520778 ) writes: on Tuesday February 13, 2007 @05:18PM (#18003266)

Wasn't it the failure of the UAC that allowed the demons from hell to infiltrate Earth?

I guess MS didn't learn anything from id.

Re:An even bigger hole... (Score:3, Funny)

by minus_273 ( 174041 ) writes: <aaaaaNO@SPAMSPAM.yahoo.com> on Tuesday February 13, 2007 @05:19PM (#18003280) Journal

seems like you are coming to a sad realization [apple.com] cancel or allow?

Re:An even bigger hole... (Score:5, Funny)

by halltk1983 ( 855209 ) writes: <halltk1983@yahoo.com> on Tuesday February 13, 2007 @05:21PM (#18003318) Homepage Journal

I see *someone* never used Windows 95!

Re:Tetris is a brand name (Score:5, Funny)

by blackmonday ( 607916 ) writes: on Tuesday February 13, 2007 @05:26PM (#18003406) Homepage

Your post is even funnier if you read it out loud in the Simpson's "Comic Book Guy" voice.

Re:An even bigger hole... (Score:1, Funny)

by Anonymous Coward writes: on Tuesday February 13, 2007 @05:33PM (#18003508)

Did you try your 8mm player?

Re:An even bigger hole... (Score:5, Funny)

by steveo777 ( 183629 ) writes: on Tuesday February 13, 2007 @05:34PM (#18003528) Homepage Journal

I think a full bootup a victory on Windows ME would be even more excuse for celebration.

Re:DOOM: History repeats itself (Score:4, Funny)

by chrisb33 ( 964639 ) writes: on Tuesday February 13, 2007 @05:35PM (#18003538) Homepage

You think UAC is bad now? Just wait for Vista II: Hell on Earth [wikipedia.org]

Re:It's not the software. (Score:5, Funny)

by LiquidCoooled ( 634315 ) writes: on Tuesday February 13, 2007 @05:41PM (#18003648) Homepage Journal

Sounds like Clippy has been re-incarnated.

*shudder*

Re:An even bigger hole... (Score:5, Funny)

by EXMSFT ( 935404 ) writes: on Tuesday February 13, 2007 @05:42PM (#18003674)

Sorry, did I miss something? I was too busy clicking "Allow" 7 times to notice which one was bad. None of them were bad, were they?

Re:It's not the software. (Score:4, Funny)

by bjackson1 ( 953136 ) writes: on Tuesday February 13, 2007 @06:05PM (#18004004)

Vista: This is from AMD. Do you trust AMD?
Me: yes, they pay me. I trust them. (click) .....

Wait, you TRUST your employer? What is this board coming to?

Re:It's not the software. (Score:5, Funny)

by Minwee ( 522556 ) writes: <dcr@neverwhen.org> on Tuesday February 13, 2007 @06:06PM (#18004020) Homepage

He did warn us that if we struck him down he would become more powerful than ever.
Maybe we should have listened.

Re:It's not the software. (Score:5, Funny)

by shmlco ( 594907 ) writes: on Tuesday February 13, 2007 @06:20PM (#18004254) Homepage

"You are coming to a sad realization. Cancel or Allow?"

I'm a PC (Score:1, Funny)

by Anonymous Coward writes: on Tuesday February 13, 2007 @06:29PM (#18004384)

Mac: "Hi, I'm a Mac."
Security: "Mac is attempting a salutation; allow or deny?"
PC: "Allow."
Mac: What's up PC?"
Security: "Mac is asking a question; allow or deny?"
PC: "Allow--yeah, um, it's this new security feature built into Vista. It's a little annoying, but it makes security rock-solid."
Mac: "Oh yeah? Well, that's cool--hey, want to play a game of Tetris?"
Security: "..."
PC: "Tetris? Well I'm a bit rusty, but--hey Security, how come you didn't say anything?"
Security: "Pfft--It's Tetris, I mean, I don't give a shit..."
PC: "Well, OK, I just thought it was kinda odd that you didn't ask. So Mac, refresh my memory, how do you play this game ag--"
Mac: "F**K YOU BUDDY!"
Mac takes out Vista Security guard with Uzi.
PC: "Whoa! What is this Mac, I thought we were down?"
Mac: "DOWN ON THE FLOOR MOTHER F**CKER!"
Mac shoots PC with Uzi; PC blue-screens.
Mac takes picture of blue-screened PC, saves it to cool photo album he created with iLife! [TM]

Re:It's not the software. (Score:5, Funny)

by Bastard of Subhumani ( 827601 ) writes: on Tuesday February 13, 2007 @06:36PM (#18004464) Journal

Classic windows security. You can either do anything, or you can't even change the background picture.

Re:It's not the software. (Score:1, Funny)

by vakuona ( 788200 ) writes: on Tuesday February 13, 2007 @06:36PM (#18004472)

Wish I had mod points.

Re:It's not the software. (Score:5, Funny)

by maxwell demon ( 590494 ) writes: on Tuesday February 13, 2007 @08:24PM (#18005810) Journal

You have just clicked yes. Did you really want to click yes?

Re:An even bigger hole... (Score:4, Funny)

by Captain Splendid ( 673276 ) writes: <capsplendid@@@gmail...com> on Tuesday February 13, 2007 @08:25PM (#18005822) Homepage Journal

I don't know why everybody harshes on ME. Sure, you have to beat it into coma before it behaves, but after that, it's almost as good as windows '98!

So True So True So True (Score:1, Funny)

by Anonymous Coward writes: on Tuesday February 13, 2007 @08:48PM (#18006070)

'Microsoft's Mark Russinovich'

Boy is THAT ever true!

Re:An even bigger hole... (Score:4, Funny)

by phayes ( 202222 ) writes: on Tuesday February 13, 2007 @10:25PM (#18006964) Homepage

Because on Linux/Mac, sudo allows one preemptive security check to enable a process to do multiple admin tasks, where UAC prompts on each action. This is analogous to house training a dog. Sudo gets the dog to ask to be let out where he takes care of business. UAC gets the dog to ask: Can I piss on the carpet, then can I do a dump on the rug, then ...

Re:It's not the software. (Score:5, Funny)

by smittyoneeach ( 243267 ) writes: on Tuesday February 13, 2007 @10:46PM (#18007114) Homepage Journal

a good operating system should make you feel like you're in control of your computer
Kernel (Jessup): Son, we live in a world that has firewalls, and those firewalls have to be guarded by software with guns.
Whose gonna do it? You? You, Slashdotter? Windows has a greater responsibility than you could possibly fathom.
You weep for Tux, and you curse the DRM. You have that luxury. You have the luxury of not knowing what Windows knows.
That Tux's death, while tragic, probably saved lives. And Window's existence, while grotesque and incomprehensible to you, saves lives.
You don't want the truth because deep down in places you don't talk about on Slashdot, you want Windows on that firewall, you need Windows on that firewall.
Windows use words like honor, code, loyalty. Windows uses these words as the backbone of a codebase spent defending something.
You use them as a punchline. Windows has neither the time nor the inclination to explain itself to a Slashdotter who rises and sleeps under the blanket of the very freedom that Windows provides, and then questions the manner in which Windows provides it.
Windows would rather you just said thank you, and bought copies for your entire extended family. Otherwise, Windows suggests you pick up a browser, and send a POST.
Either way, Windows doesn't give a damn what you think you are entitled to.

;)

Re:It's not the software. (Score:5, Funny)

by shut_up_man ( 450725 ) writes: on Tuesday February 13, 2007 @11:01PM (#18007194) Homepage

Great, it's Darth Clippious.

Re:It's not the software. (Score:5, Funny)

by macserv ( 701681 ) writes: on Wednesday February 14, 2007 @01:08AM (#18008068)

Are you sure you want to cancel the operation?
[ OK ] [Cancel]

Re:It's not the software. (Score:5, Funny)

by Milton Waddams ( 739213 ) writes: on Wednesday February 14, 2007 @09:31AM (#18010588)

PopeRatzo: "DirectX10? It's going to take more than DirectX10 for me to accept my computer as a spy in my home."

Microsoft: "Well, what if we give you a nicer looking start menu too?"

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

"Very Severe Hole" In Vista UAC Design 813

"Very Severe Hole" In Vista UAC Design More Login

"Very Severe Hole" In Vista UAC Design

Another approach. (Score:5, Funny)

Re:An even bigger hole... (Score:5, Funny)

Steve is that you? (Score:5, Funny)

Balancing Security with Ease of use (Score:5, Funny)

Re:An even bigger hole... (Score:5, Funny)

DOOM: History repeats itself (Score:5, Funny)

Re:An even bigger hole... (Score:3, Funny)

Re:An even bigger hole... (Score:5, Funny)

Re:Tetris is a brand name (Score:5, Funny)

Re:An even bigger hole... (Score:1, Funny)

Re:An even bigger hole... (Score:5, Funny)

Re:DOOM: History repeats itself (Score:4, Funny)

Re:It's not the software. (Score:5, Funny)

Re:An even bigger hole... (Score:5, Funny)

Re:It's not the software. (Score:4, Funny)

Re:It's not the software. (Score:5, Funny)

Re:It's not the software. (Score:5, Funny)

I'm a PC (Score:1, Funny)

Re:It's not the software. (Score:5, Funny)

Re:It's not the software. (Score:1, Funny)

Re:It's not the software. (Score:5, Funny)

Re:An even bigger hole... (Score:4, Funny)

So True So True So True (Score:1, Funny)

Re:An even bigger hole... (Score:4, Funny)

Re:It's not the software. (Score:5, Funny)

Re:It's not the software. (Score:5, Funny)

Re:It's not the software. (Score:5, Funny)

Re:It's not the software. (Score:5, Funny)

Related Links Top of the: day, week, month.

Slashdot Top Deals

Slashdot