Russinovich Says, Expect Vista Malware

Hypertwist writes "Despite all the anti-malware roadblocks built into Windows Vista, Microsoft technical fellow Mark Russinovich is lowering the security expectations, warning that viruses, password-stealing Trojans, and rootkits will continue to thrive as malware authors adapt to the new operating system. Even in a standard user world, he stressed that malware can still read all the user's data; can still hide with user-mode rootkits; and can still control which applications (anti-virus scanners) the user can access. From the article: '"We'll see malware developing its own elevation techniques," Russinovich said. He demonstrated a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file.'

And ... ?

[khasim]

So now you know that Vista can be compromised ... what are you doing about it?

Where's the clean boot disk that I can use to scan a Vista box? How do I validate all the files on it?

What is your answer to AFTER the box has been cracked?

Re:And ... ?

[Anonymous Coward]

To be fair, Vista's ultimate solution is probably no different from any other system:

Nuke it from orbit, reinstall.

The only difference is the hope they don't deny your registration after doing that too many times.

I suppose they could have a "Boot from CD and validate" option, but, because of subsequent system changes as the user installs drivers and other legitimate software (which could still include bogus stuff), it would probably be tricky to implement except for a few key system files that don't (or shouldn't) ever change, and that would miss alot of malware. More useful would be if it were possible to create a "known good" system image, and a way to compare that to the present state of the system or to reinstall that image. I know that XP has system save points (or whatever they are called), but I'm thinking about something more comprehensive. Do they have anything like that yet?

Re:Actually

[SEMW]

Actually, I'm really quite surprised by this.

Quite surprised by what, that programs running in user-mode can still access the current user's data and programs in their home folder? Hardly news.

(I was slightly confused by the statement that programs "can still hide with user-mode rootkits", though -- surely if a rootkit is running with LUA privs, it wouldn't be able to hide itself? I thought the whole point of a rootkit was that it allows malicious programs to maintain root (i.e. highest privilege) access undetected, which would make "user-mode rootkit" a bit of a contradiction in terms, unless I'm misunderstanding somewhere...?)

(And whilst I'm posting, "...a social engineering attack scenario where a fake elevation prompt can be used to trick users into clicking "allow" to give elevated rights to a malicious file"? If it's a prompt that will give a malicious program elevated rights when the user clicks 'allow', what part of it is fake? Surely a fake/spoofed dialogue box wouldn't *actually* be able to grant elevated rights (pretty much by definition); and the text in the *real* elevation prompts can't be changed, since they run in 'secure desktop' sandbox mode, no?)

Not necessarily.

[khasim]

I can boot with a LiveCD and mount the hard drive so that NONE of its files are being run.

Then I simply match each and every file on the hard drive to the package that it should have come from and validate the md5 checksum.

Any file that is NOT accounted is suspect and can be individually evaluated. Most of them should be data files that are not executable.

Remember, in Linux, everything is a file and the boot process is very clearly defined. If something is running on your machine, you can find what it is and why it is running.

Any system that REQUIRES a complete tear down after ANY vulnerability is exploited is NOT a well designed system. There has to be a way to validate each section of the system.

Unix-style permissions are not enough.

[earthbound kid]

People sometimes talk like strong enforcement of Unix-style permissions is sufficient to provide local security. I find that argument totally unconvincing. Yes, it's nice to have the confidence that with modern OSes like Linux, OS X, and (probably) Vista I won't end up like the old Windows where you have to reformat a disk to try to clear the deeply dug in roots of some spyware crap from the system, but there's still the pretty damn big issue of all my data. Namely, having to reinstall the OS would be a pain, and I'm glad I don't have to waste an hour doing it, but losing all my data (documents, photos, music, and to a lesser extent application preferences) would be devastating. The data on my PowerBook is my life, and the reassurance that at least I don't have to reinstall OS X would be cold comfort at best. True, I do make a monthly backup onto an external drive that is normally unplugged (and thus out of range of rm *ing attacks), but probably most users don't follow this practice. Besides, a subtler virus could just silently corrupt my data over a period of months, so that I don't notice what's going on until my backups are no longer any good!

There is a solution to the problem, but it requires a deep rooted change in how things are done. What I propose is that we shift from permissions by user to permissions by application. Right now, any app that my user launches can erase any of my files. That's ridiculous! Much more logical would be allowing me to decide which subset of my files each app can user and how. So, for example, I would let FireFox write downloads to my desktop and its preferences and caches to subfolders of the Library, but I wouldn't want it to be able to erase any of my other files under any circumstances. In fact, most of the time I don't even want FireFox to be able to read my local files, but I'd be willing to put in a password to let it do on a time limited basis so during uploads and the like.

Basically, what I'm proposing amounts to sandboxing every app. This may seem harsh, but why not do it? What's the advantage of letting any app destroy any of my files? Make them at least beg me for permission first, I say!

So, that's what's on my wishlist for the future of OS level security.

Re:Not necessarily.

[SLi]

In theory, yes, you can do that. In reality though in any reasonable system quite a number of configuration files have been modified, and the users have stuff in their home directories that does not directly come from any installation CD that could be used for at least a user-level exploit (which makes a root exploit dramatically easier). In such a system it is generally quite a bit less work actually to do a reinstall and reconfiguration than combing all the files with the kind of comb you need to catch all things evil. It's like trying to find the proverbial needle in the haystack, except that the needles have been deliberately hidden and you don't know how many there are – and if you miss one, you lose.

Re:Actually

[lpw]

Providing a truly secure OS is antithetical to the Windoze Nature, i.e., that of an OS for dummies. Maintaining a secure system takes time, know-how, and sometimes even reading some fucking manual. But Microsoft's "operating systems" are intended for the PC, a platform where the majority of users are not willing to make that investment. Eventually, once the novelty of MS Paint wears off, a user needs to install another application in order to actually accomplish something useful on the PC. Because MS necessarily assumes that the user is a brain-dead clod, a simple scheme like the allow-or-deny elevation masquerade is necessary (and, of course, the user can be easily duped into installing malware). Anything more sophisticated, and the appeal (and usability) of Windoze to the masses suffers, because it's no longer "user friendly." After all, if grandma needs to dick around with file and process permissions, why not just install Linux? No version of Windoze will be a truly secure system until its user base becomes better educated, which is a requirement that Microsoft will never enforce to protect their bottom line.

Re:Flash BIOS exploits

[QuantumG]

Hmm.. wonder if you could flash a CD-ROM drive to run arbitary code on start-up.. presumably yes.

Re:Actually

[313373_bot]

What if Microsoft wrote a new OS, and no one bothered writing applications for it, not even malware? Despite all ineffective security and bad design decisions, the prevalence of viruses, trojans and spyware on previous Windows versions were (and are) in part due to their sizable market share. If Vista Me II isn't being attacked like old Windows, is it because it's so more secure, or is it because no one cares? Only time will tell, but I can't take of my mind the image of a mighty tree falling in the middle of a forest, with no one to hear it.

Re:Actually

[Fhqwhgadss]

surely if a rootkit is running with LUA privs, it wouldn't be able to hide itself?

Too bad there are lazy software companies pulling this kind of shit [chessok.com]. The developer's link to this piece of shit "patch" is listed under the headline "Convekta's products are compatible with Windows Vista !!!" (just disable the single most important security feature of the OS). I'd bet that over half of all Vista boxes will have LUA disabled within 12 months of installation. What do you have then? A new OS with the security enhancements removed and untested code running in "every user is a superuser" mode, just like XP without the 6 years of bugfixes. Don't tell me XP has limited accounts; using XP under a limited account takes more effort than using Linux ever did.

The only thing keeping the malware writers away from Vista so far is its piss-poor market penetration, not its security enhancements.