"Very Severe Hole" In Vista UAC Design 813
Cuts and bruises writes "Hacker Joanna Rutkowska has flagged a "very severe hole" in the design of Windows Vista's User Account Controls (UAC) feature. The issue is that Vista automatically assumes that all setup programs (application installers) should be run with administrator privileges — and gives the user no option to let them run without elevated privileges. This means that a freeware Tetris installer would be allowed to load kernel drivers. Microsoft's Mark Russinovich acknowledges the risk factor but says it was a 'design choice' to balance security with ease of use."
An even bigger hole... (Score:5, Insightful)
There's a much, much bigger hole than any programmer could possibly exploit: The annoyance factor.
Last night, I restored my old XP partition after figuring I'd give Vista a shot for just a couple of days. You know, just to experience it myself instead of taking other people's word for what it's like.
The theme of Vista seems to be simple: Annoy the hell out of he end user. You want to run an application, is that okay? You want to copy a file, is that okay? You want to change your desktop background, is that okay? You want to copy text from IE7, is that okay? You want to delete an old text file, is that okay? You want to paste text into a form field in IE7, is that okay? The list goes on and on. Almost every action in Vista is actually compose of two separate actions: the one you want to do, and the confirmation to do it.
After getting Windows Vista installed, I took an hour or so to configure my personal settings and install a couple of applications. I had to acknowledge somewhere between 50 and 100 dialog boxes asking me if it was okay to do what I was doing. No, I'm not exaggerating.
Now, I'm a very experienced computer user, and I've worked for over a decade supporting PCs, servers, networks, and so on. Yes, I know, I could disable UAC if I want to, but that kind of defeats the point of Vista's so-called beefed up security.
Even I became so numb to clicking OK in two short days that I wouldn't think twice about it. You want to move that shortcut on your start menu, is that okay? You want to install the Pwnzjoo virus, is that okay? You want to send your bank account numbers to Nigeria, is that okay? Yes, yes, yes, dammit!
If Microsoft wants to really get serious about security, they have to get it through their heads that it's not about locking everything down and popping up prompt after prompt after prompt to the user. It's about being smart, letting the user do normal things without interference or interruption, and having the level of alerts match the danger of what's being done.
As it is, Vista cries wolf so often that when the real wolves show up, I'd be surprised if any user, newbie or guru, listens.
So what's new? (Score:3, Insightful)
I believe that even RPM on linux runs the install scripts with admin access...
"balance" ease of use (Score:3, Insightful)
While I'm at it, why does a printer (or other non-intrusive peripheral) driver have to have unfettered access to the life blood of the OS?
Re:So what's new? (Score:2, Insightful)
Further proof (Score:5, Insightful)
When are they finally gonna give up this retarded backward-compatibility-at-all-costs mindset and *really* rewrite Windows from the ground up? Microsoft owns Virtual PC for Christ's sake, so it's not like they couldn't include a sandboxed "classic" Windows for app compatibility for a few years.
The one thing Apple did that Microsoft really ought to copy, they don't. Figures.
Swinging a Blunt Object (Score:5, Insightful)
"What? We put the thingy in. It's not our fault if idiotsticks turns it off because he's too lazy to take security seriously."
This is a way to let themselves off the hook, escalating user error to the root of all evil instead of, say, a hopelessly fractured and bloated development bureaucracy overseen by demented lizard people. This is a response to the criticisms about Windows having a default configuration more favourable to trojans than users, so they can now claim that the default configuration is solid. You changed a setting? The buck stops at you, sucker.
Maybe Microsoft needs someone with some insight into user behaviour and interface psychology on staff. I hear Steve Jobs has a reasonable hourly rate. (/me ducks)
You ought to watch those irrational beliefs . . . (Score:5, Insightful)
rpm itself doesn't require root authority, and if everything you intend to do with rpm happens in directories to which you have write authority, rpm will work just fine.
By default, rpm does use directories (notably, in /var) which will require running with root authority; but this can be overridden with command line switches (say, to install an rpm which will only be used by you).
RTFM.
In a nutshell: (Score:2, Insightful)
Oh, this is rich ... (Score:4, Insightful)
Microsoft has created a culture of choosing between security/good/whatever and 'ease of use'. Going all the way back to older versions of Windows in which there was no user permissions model.
Hearing that all frigging installers are going to want admin perms is a frigging joke. Part of the reason Windows is insecure is you can't do anything without being an admin. It's not like it even supports a model whereby you install the software into your own location. Every piece of software expects to be able to write registries, replace system DLLs, and generally crap into a few common folders.
I mean, well over a decade I could download any old UNIX software, untar it, set an environent variable, and just run the damned software. No root perms needed, just glorious, easy to run/trivial to uninstall software.
This means that people aren't going to install their animated cursors in a sandbox which only affects them. They'll do it as admin, and potentially bork the whole machine.
This just makes me laugh.
Cheers
Re:An even bigger hole... (Score:5, Insightful)
Mac has issued a salutation. Allow or deny? Comedy gold, and yet Apple hit the nail on the head.
My expectation is that at least 50% of Windows Vista consumers will turn UAC off entirely, and the remaining 50% will ignore it (psychologically disable it) to the point that it may as well be disabled - especially applies in the enterprise computing world where Joe won't be allowed to turn it off, but still wants to do whatever he wants. Meaning that in the default configuration of users as hobbled admins, every Vista user is then an admin. Just like they are in XP. Really validates 5 years of hard work on security.
Re:An even bigger hole... (Score:1, Insightful)
Re:Hole? (Score:3, Insightful)
The expert Vista user can get around running installation programs as the Administrative user as well. It's the same issue.
Apple got it right (Score:5, Insightful)
1. Drag application folder where ever you want it
2. If application does need to install a control panel, kext, or any other system file, then you can create an installer. When the installer tries to install the files that need the elevated permissions, it then tells you what it is trying to do and asks for an admin user/password
How is that hard to grasp at MS? Assuming everything needs admin permissions is just insane, and insisting it isn't a security hole and is a "design choice" is just fucking retarded.
Re:An even bigger hole... (Score:2, Insightful)
UAC vs SU ROOT (Score:2, Insightful)
In the unix world, if I want to modify a file that I don't own I must elevate my permissions using something like su root. And that's somehow *less* annoying than Vista's UAC prompt?
The only time I can see this being more annoying is when I'm doing lots of actions that require admin privs. Microsoft did their best to group operations in such a way that you only get one prompt. If I try and delete 20 files, all of which I don't have access to, I'll get 1 UAC prompt.
But sometimes they can't group these operations together, such as when I'm installing several applications when I'm first setting up my machine. In these scenarios, su root is superior in the sense that I su root once and that's it. With UAC, I'll get a prompt for each install.
But if you know you're going to be installing lots of applications and you don't want to be bothered with multiple UAC prompts, then just turn off UAC while you're doing those installations. Simple as that. And not harder that su root.
So what's the big deal? The vast majority of users don't install new applications every day. In fact, the vast majority of users don't do anything that requires admin privs on a daily basis. This is a non-issue.
I've been using Vista since late November. During the first few days of use I got a lot of UAC prompts, but I really didn't find them all that annoying. One extra click just wasn't a big deal. After getting my machine setup the way I wanted it, I rarely got any UAC prompts. Just doesn't happen all that often.
Since almost everybody who will run Vista will get it on a new machine with most of the software they will use pre-installed, this is even more of a non-issue.
But the biggest point is that the way that unix does it, with a session-based elevation, is no less time consuming (in fact, it's usually more time consuming), and it's FAR more dangerous for a "dumb" user because they will tend to just leave their session elevated.
Re:Troubling ... (Score:3, Insightful)
The problem, as I see it, is that the large companies are not interested in your privacy. In fact, they're interested in invading it. They'll say that they just want to serve you better as a customer, but it's really long-term surveillance. If big business was interested in using the Internet as a vehicle for expansion rather than exploiting consumers, we'd see reliable and cheap wifi-enabled routers in every home with broadband. Windows viruses would be nothing more than an annoyance, maybe even a joke like in the good old days. And everyone would know how to protect themselves from them. They certainly wouldn't threaten to cause billions of dollars of unaccountable transactions.
The funny thing is that before big business discovered the Internet, there was a considerable community movement toward ensuring that everyone was able to implement basic security. After all, your machine is a potential security threat to me if you fail to secure it, much like a ski that doesn't have those little brakes on them could become a hazard to the entire hill when you wipe out.
Re:An even bigger hole... (Score:5, Insightful)
There have also been a number of times in my career where I have had to use development software written by companies that either went out of business, or stopped supporting that software. What then?
What Apple understands and Microsoft does not is that it is not my job to make the OS work better. It is the OS's job to make my life easier.
Re:It's not the software. (Score:5, Insightful)
Re:It's not the software. (Score:5, Insightful)
Regardless, I think that a Windows version of sudo is a very good step. They just should have spent more time working on permissions so that it didn't trigger so much (assuming that what the posters' have said is accurate). The setup thing in TFA is kinda stupid, but installers almost always write to Program Files in Windows, and rarely have a per-user installation method like in Linux. A better solution would have been to try and encourage installers to have a per-user installation method.
Anyways, it may be that I'm just lucky that I haven't had a lot of problems with UAC. But I haven't had to go registry diving or modify any system directories in Vista yet, so theres that too.
Re:It's not the software. (Score:5, Insightful)
Re:It's not the software. (Score:2, Insightful)
Re:An even bigger hole... (Score:4, Insightful)
Everyone seems to be making a huge deal out of nothing and they alway get +5 moderation for doing so. If you dont like UAC then shut it off and move on, its not that hard...oh wait I forgot. Microsoft sucks no matter what they do!
People who complain about UAC don't understand UAC (Score:5, Insightful)
VMWare 6, for example, constantly elevates on Vista. What do you want to bet that VMWare 7 won't?
Well behaved programs elevate only when and where they have to. Even if 50% of Vista users turn UAC off, that's still 50% of your client base who is being constantly bombarded by elevation dialogs. The solution? Write your software so it doesn't need to elevate.
As for the article - installers pretty much have to elevate. This is true on Windows and with Linux packages (when was the last time you ran apt-get without using sudo or running as root?). Some have pointed out that you can install most packages in Linux to be specific to your user account, using special flags. This, of course, is possible in Vista as well, if MSI packages are used.
Note that I do agree that it's a problem that you can't override UAC detection. There needs to be a "don't run as administrator" option.
Re:It's not the software. (Score:4, Insightful)
The problem with UAC is that it fails to separate the two orthogonal issues of sanity-checking the user's behavior, and maintaining system security. Consider how "Program Files" is handled. Browsing into "Program Files" throws up a UAC alert. It shouldn't do that --- "Program Files" is readable to everyone. Writing to "Program Files" should throw up a UAC alert, but only the first time in the caching period. The question at that point isn't "Do you really want to modify this directory" (of course I do!), but rather "Do you want to give Explorer.exe permission to modify this directory". When you follow the first train of thought, you end up with prompting the user each time, because obviously each copy requires a separate sanity-check. If you follow the second train of thought, you see that the caching mechanism is just fine, since if Explorer.exe was authorized 30 seconds ago, it's unlikely it was compromised since then, and should retain that authorization.
Re:Dammit (Score:4, Insightful)
In reality, the hardware is optimized for speed. That is, the core will execute the instructions it receives without any sort of bounds checking. If an instruction fails, then an error code is stored and the next instruction is fetched and executed. It's only during boot time that a kernel has the opportunity to install code at particular vectors to prevent other code from sitting there. That's the PC architecture -- it was designed years ago and for good or bad, we're stuck with it (Ironically, many people make the same argument about Microsoft). That's why the kernel is so important: if it fails to protect a particular interrupt vector or other system integration point, then a userland program can elevate itself to kernel-level privileges and walk all over both the running OS and the data on your hard drives.
The only way to implement your idea (and many others like it) would be to have the hardware recognize this "code source" (or whatever magic bullet you have defined) and act accordingly.
Long story short, people are looking for a technological solution to a lack of education. Like it or not, there's a lot of people on the Internet now that need education. Vista's UAC seems to be along those lines, though extremely insulting and inflexible to an advanced user. It's like it was designed to "raise awareness" of "potentially unsafe operations" so that someone who was previously a clueless idiot can now see that many operations are potentially unsafe. Of course, the prompts don't explain WHY to this person, which eliminates UAC even as an education tool.
Re:It's not the software. (Score:4, Insightful)
If you cached the elevated credentials authorization for "X" minutes, or whatever, you would be giving a free pass to any malware that happened to be trying to do something bad. That's an incredibly bad solution. But I have to assume that's not what you're suggesting.
That make sense?
Why have installer at all ? (Score:4, Insightful)
2) Installing a downloaded Tetris game allows the game installer to change virtually anything in the system.
Why does a game need an installer at all ? Why not just unzip the game into your user account/home directory or better yet drag the game icon to the place you want it ? Why do Windows applications all seem to need an installer ?
On OS X and NeXTstep before it, application icons are actually covers for directories containing all of the support files including executables need by the application. Furthermore, applications are not supposed to assume that they can write to their own directory. This is convenient for running applications from servers without installing on the local machine or for running directly off a CD-ROM. If an application needs to store user data or write configuration files, there are standard places to put the files. When needed, the individual application copies files to standard places using the user's permissions and not admin permissions.
The first time any application is run, the user is asked if it is OK. If some crap is downloaded and executed unintentionally, the user is given a chance to say WTF and stop it. Any time any application needs privileges beyond the user's default privileges, an admin passwd is required.
No installers (except in crap-ware and unusual circumstances and even then they require an admin password for upgraded privileges!
Remarkable little user irritation.
Why can't Microsoft copy this behavior ? It has been for sale since 1988.
OS X isnt perfect, but sometimes it is better.
Re:It's not the software. (Score:3, Insightful)
It's a good start, but not for 2007. This stuff should have been in Windows 95.
Did not have to be true (Score:3, Insightful)
I would argue this notion is fundamentally wrong.
An installer should only have to elevate if it has to modify the system, or possibly existing applications in some way.
I don't have to elevate for all Linux installations for example if I am not going to install something in
In OS X you can install an application just fine without elevation, unless again it requires system access - but most software is self-contained and has no need to add system files. Thus when an installer asks you for a password you have a better feel if whatever app your installing should really have that level of access.
In Vista you cannot have any installer do any setup things (like prepping directories or checking to upgrade a program) without running as admin. This is madness, because you are going to always be telling vista it's OK for even the most trivial installer to go ahead and elevate.
Re:It's not the software. (Score:5, Insightful)
No, people aren't bitching about them doing something, they're bitching about them doing something WRONG. Linux and Mac's have a similar approach to this problem, but their solution (sudo) is not annoying, so it actually works. All Microsoft had to do was copy that solution to improve security, instead they came up with their own and made it obtrusive in the process.
I have yet to experience these supposed headaches with Vista yet, the only time that shield pops up is when I run a program that is potentially harmful to my computer
Although I also have not seen these prompts when copying text, I have seen them in plenty of places aside from installing programs. Places that make absolutely no sense, such as storing wireless settings. There is no reason that action should require admin privileges and thus a prompt.
How many story's were posted about programs looking like they came from an official place only to release a trojan? sure you get a program from download.com and figure it's safe but after installing a program it suddenly fucks up your PC, with Vista it will actually ask if you trust it let you know where it came from the works.
And how would that help? You download a program from somewhere, and double click to install it. Whether it is a trojan or not, Windows is going to ask you for permission. Since you downloaded it, you obviously think it is not a trojan, so you would press Ok on the permissions dialog. Turns out it is a trojan, and your system is compromised. A permission dialog does nothing to protect you here.
Re:It's not the software. (Score:5, Insightful)
Higher up in the thread someone mentions what happens when you copy a file to a folder in Program Files. Because Program Files folders are protected you need elevated permissions to do that. The right thing to do is say that it requires elevated permissions, ask if you want to do it, then do it. But in some cases it asks you 3 times for one file (do you want to copy, do you want to elevate, do you want to overwrite, do you want to be admin, do you need help with writing your letter). Why can't they give you one box that says, "The file already exists and this copy requires administrator rights, do you want to allow this?", then when you say OK, you are done. Why, why, why can't they do this, are they short of money?
And Mac and Linux do exactly the same thing, they ask your permission to do admin tasks, except they got the details right so they don't irritate the user to death. A guarantee people are just going to shut off UAC because it's annoying, defeating the whole purpose.
Re:Swinging a Blunt Object (Score:5, Insightful)
You know, if any *nix software required the user to be root to run, we would string the developers up alongside the guy who thought Clippy would be a good idea.
Why should it be any different for third-party applications requiring Administrator privileges to run on Windows?
Microsoft is so busy catering to the third party developers in order to maintain their lock-in, that they forgot how to put their foot down on truly important software engineering issues, like security. Locking down XP to an almost *nix-like state can be done. There are read/write/execute permissions available on every directory, drive letter, and registry key, and Windows supports the "home directory sandbox" model. After all, a virus in *nix could conceivably blow away a user directory, but unless it's exploiting a buffer overflow or other coding error hole, it can't take down the system. The same is possible in Windows, but not available by default to your average Dell user.
Re:An even bigger hole... (Score:3, Insightful)
Re:I agree with MS' choice. (Score:2, Insightful)
Ouch! I think this is MS making the same stupid design descisions again, and in this case it's the one where a 'special*' filename is treated in a 'special*' way.
I'm not talking 'special*' as in /boot is special - if I write an executable at /boot/banana/kill_all_humans, my system will ignore it, just as it will ignore C:\Kill~1.exe. I'm talking 'special*' as in a file with a particular name will be treated in a particular way, regardless of the contents. Think of all those old exploits where someone put an executable in an email with a jpg or other extension. This is the same brand of stupid all over again.
I'm not saying that correct naming isn't important, I'm just saying that the file contents are more important than its name. If someone offers me "chocolate" and hands me dried cat shit, I'm not going to eat it. I'll dispose of it and most likely take violent action against whoever told me it was chocolate. I expect my computer to behave the same way, apart from the violence bit of course.
They could have changed the executable format and provided a sandboxed legacy OS for older software as other posters have suggested. If there is no easy way of recognising different kinds of .exes, their contents and privileges required, it just highlights the problem MS is having in retrospectively fitting security to a broken model. The fact that they are still using 'special*' executable installers highlights that they haven't really thought these issues through. The fact that they are still using 'special*' filenames shows that they are adding to there existing legacy of 'special*' architecture.
For the record, I'm not an anti MS zealot. I own an xbox, I just don't let Windows near my home PC.
* In Canada, special means retarded.Re:Swinging a Blunt Object (Score:2, Insightful)
Re:It's not the software. (Score:5, Insightful)
I don't want to wonder if my computer is tattling on me if I'm downloading an mp3 without DRM or watching a copy of a video that a colleague gave me. I don't want to think my computer is a rat or a punk. I don't want to think my computer will rebel if I run a perfectly legal program like Alcohol or rip.net or want to install the k-lite mega codec pack.
DirectX10? It's going to take more than DirectX10 for me to accept my computer as a spy in my home.
Re:It's not the software. (Score:3, Insightful)
Setting up any network settings on Linux requires sudo. It is an administrative task and so requires administrative priviledges. On most Linux systems you need to authenticate before you make any changes, and often before you can even view settings. This is right and proper behavior.
Where MS Windows Vista fails is in completely mucking up the whole concept of permissions. As an administrator, I don't want my users (or myself as a non-admin user) to even be aware of network settings, and certainly not be allowed to change them. If the network is failing, they need an adminitrator to sort it out. If the user has sudo priviledges and can fix it, that's great but they'll have to authenticate first. There is rarely a need to confirm changes because it is assumed that an administrator knows what they're changing.
MS Windows Vista lets you do whatever you want, then asks you if you're sure you want to do it, then asks if you're really sure you want to do it, then tells you that you can't do it.
The point is removing barriers between a user and his or her goal. Linux does this very elegantly. Apple does it elegantly and prettily. MS does it in a way that is as elegant as an elephant trying to turn around in an elevator, and as pretty as what the elephant leaves behind.
MS hasn't failed because they tried to implement some semblance of user permissions and security, they failed because they did it in such a way that defeats the security through wolf-crying, defeats the permissions by letting anyone elevate permissions easily, and annoys the user by making tasks more difficult, complicated and time consuming than they need to be.
Re:It's not the software. (Score:5, Insightful)
And the worst part is, if you tell them the truth -- "it does that because Microsoft sucks at making software" -- they don't believe you and think you've got some kind of unfounded grudge against Microsoft!
Re:It's not the software. (Score:3, Insightful)
Yep, and it just becomes even more fucked up when you realize that Windows has a fancier permission system than unix! Why did Microsoft even bother?
Re:It's not the software. (Score:2, Insightful)
Or maybe we will have a story on here about how microsoft is dumb as hell for not implementing it sooner.
Re:Swinging a Blunt Object (Score:3, Insightful)
Similar problems apparently exist with a number of networking apps.
Re:An even bigger hole... (Score:2, Insightful)
A few weeks ago my old Dad had one of those delightful messages on his machine: "An unrecoverable error has occurred, yada yada... [OK].
As he quite rightly pointed out, "No it isn't fucking OK. What am I supposed to do now?".