UAC security hole?

Posted: 09-28-2008, 09:35 AM
The following article:

http://blogs.techrepublic.com.com/itdojo/?cat=3

....shows a way of running UAC-restricted programs without a UAC prompt.
Basically, you create the restricted program as a task in Task Scheduler,
set it to "Run with highest privileges", and then create a shortcut to the
task.

From then on you can run the program without the UAC prompt.

Regardless of what you think about UAC, doesn't this sound like a fairly
serious security breach? Bearing in mind that Microsoft have made a
software tool available for UAC-enabling old applications on a case-by-case
basis, it sounds like they didn't realise you could do it much more simply
using Task Manager.

I can imagine malware might be able to set up a new task in Task Manager,
with the highest privileges, and run hostile code without the user being
prompted.

I'm no expert on Vista's security mechanisms, but do you guys think this
could be a security hole? Do you expect Microsoft to plug this particular
"feature"?

SteveT

UAC security hole?


Responses to "UAC security hole?"

barman58
Guest
Posts: n/a
 
Re: UAC security hole?
Posted: 09-28-2008, 10:28 AM

Steve Thackery;847441 Wrote:
> The following article:
>
> 'IT Dojo | TechRepublic.com'
> (http://blogs.techrepublic.com.com/itdojo/?cat=3)
>
> ....shows a way of running UAC-restricted programs without a UAC
> prompt.
> Basically, you create the restricted program as a task in Task
> Scheduler,
> set it to "Run with highest privileges", and then create a shortcut to
> the
> task.
>
> From then on you can run the program without the UAC prompt.
>
> Regardless of what you think about UAC, doesn't this sound like a
> fairly
> serious security breach? Bearing in mind that Microsoft have made a
> software tool available for UAC-enabling old applications on a
> case-by-case
> basis, it sounds like they didn't realise you could do it much more
> simply
> using Task Manager.
>
> I can imagine malware might be able to set up a new task in Task
> Manager,
> with the highest privileges, and run hostile code without the user
> being
> prompted.
>
> I'm no expert on Vista's security mechanisms, but do you guys think
> this
> could be a security hole? Do you expect Microsoft to plug this
> particular
> "feature"?
>
> SteveT
Hi Steve,

As the UAC operates on task scheduler anyway I think the hole is
plugged. the method you mention is a way for an admin to provide access
to UAC controled apps to a standard user without providing a password.
you still have to go through the UAC to set it up.

hope this clarifies


--
barman58

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do not
understand.,- frank herbert
Steve Thackery
Guest
Posts: n/a
 
Re: UAC security hole?
Posted: 09-28-2008, 10:56 AM
> The method you mention is a way for an admin to provide access
> to UAC controled apps to a standard user without providing a password.
> you still have to go through the UAC to set it up.
OK, so you're saying that malware that attempted to set up such a task would
itself trigger the UAC prompt?

That makes sense. I hope you are right and that there aren't any
workarounds. I'm one of the few people on the planet who actually
appreciates UAC. I'm only too pleased that Vista warns me when something
with security implications is about to happen.

SteveT

barman58
Guest
Posts: n/a
 
Re: UAC security hole?
Posted: 09-28-2008, 11:37 AM

Hi steve

Yes that's the way it I believe it operates, the UAC requires use
input and the disabling of the desktop (Screen Blanking) means tha
malware cannot simulate this input

I too am a believer in the UAC what we need now is for softwar
developers to work to the regime and not write user programs to requir
Admin rights, which is where a lot of the disstisfaction with UAC come
from. This requirement was within the Spec for XP (just not implemented
so they have no real excuse after all this time. Vista's implementatio
of the spec will push then in the right direction but I won't be holdin
my breath. Until this requirement is met Admins who work in the rea
world will have to resort to these type of workround

--
barman5

Regards,
*Nigel*
the beginning of knowledge is the discovery of something we do no
understand.,- frank herbert
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Did I put a hole in my Trend Micro security wall? Vista Novice Windows Vista Security 1 12-06-2007 10:39 AM
How do I report a security hole in IE to microsoft??? Anonymous coward Windows XP Security & Administration 0 10-09-2003 09:46 PM
Hole in security Chris H. Windows XP Games 0 08-24-2003 06:43 PM
Security hole with Mounted Network drive (OS X) Klaus Wik Apple Macintosh 1 08-01-2003 03:12 PM
Security Patch for hole in Windows XP Stephanie Myers Windows XP Security & Administration 1 07-22-2003 04:22 PM