On Wed, 2006-01-18 at 16:16 -0600, Paul Schmehl wrote: > This means that the exposure, when granting the privilege, is as follows: > 1) If you can launch a process on the local machine AND > 2) The process has embedded credentials that are different from the user > launching the process THEN > 3) The user gains those credentials' privileges ***for the length of that > process*** Yup. So if your use has that right, any spyware the user downloads via IE can use that user right to elevate credentials **for the length of the malware installation**. Does that sound right? And does that sound like something you'd want to happen? You're caught between a rock and hard spot. You need to install software, but don't want to give admin rights. So you have to meddle with user rights in order to install the software, which would leave the user again vulnerable to "other software" taking advantage of that user right. If you give that right, or admin privs, why don't you limit that only to the duration of the software install? It sounded like you were planning on granting that user right and leaving it in place. If you only grant it temporarily, the exposure is not great, imho. (Remember, I've been liberated from Windows for a couple years now ;) > So, why did M$ decide to remove this right from the user? Because it > prevents them from installing software on the box. Right. But now you find yourself having to dish out that right again to make some software work. What's wrong with that picture? ;) Cheers, Frank -- It is said that the Internet is a public utility. As such, it is best compared to a sewer. A big, fat pipe with a bunch of crap sloshing against your ports.
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/