Therefore, a poisoning
attack where you run a malicious app as a standard user and it poisons the
environment for a privileged app is less likely to succeed. You would expose
the same attack surface using currently running applications, but not using
an app that ran weeks ago.
Excellent point ... I hadn't thought about that.
I'm not sure, to be honest. I really hope it moves toward making it easier
to use multiple desktops.
Fascinating thought as well.
I'd also hope to see a lot of applications opting in for this. Currently,
the state of software quality is really poor. To be frank about it, Microsoft
builds far higher quality than most other organizations. If running as a
standard user becomes more commonplace and people start demanding it, we may
see software developers actually becoming engineers, and think about how to
engineer what it is they are doing. I've said many times that I think too
large a proportion of software developers fall into the category of "software
construction workers," not software engineers. There is precious little
engineering going into what they do - something I blame on the educational
system BTW. If they have to think about people running as standard user it
might force some engineering thought into the process. There are many
exceptionally smart software engineers out there, but the overall quality
needs drastic improvement.
I think software developers tend to take the shortest and least painful
solution to a problem in order to get their app to work, regardless of
whether it is correct or not (the "who cares if it doesn't fit in with the
way MS architected windows, it works doesnt it?" attitude). I think MS needs
to make the correct solutions to common problems less painful than the
incorrect solutions, and I think UAC accomplishes this very well, at least in
some aspects.
Yes. Better barriers between applications are necessary. A logical place for
Windows to go is to permit better separation and access control between
applications.
Agreed - Applications should only be able to talk with other applications in
a way that Windows knows about and can enforce policy on.
There is no reason why one application automatically should be
able to control another simply because they are on the same desktop.
Absolutely!
It would
be logical to direct the energy in the next version of Windows toward better
separation. That, in turn, would require fundamental architectural changes in
the OS though, not to mention the changes required in user behavior.
I agree - I think that all forms of IPC should be marshalled or handled in
some way by the OS, so that the OS can enforce privilege seperation/policy.
Is it possible to enforce 100% privilege seperation while still allowing two
different privileged processes to communciate with each other? Well, MS has
spent a good amount of time doing this protecting the Windows API, system
services processes, and user->kernel mode transition from privilege
escalation. Perhaps there could be some way for MS to generalize what they
have learned from doing this and enforce this somehow at an
application->application level, with the cooperation of software developers
(through IPC API's)? Ideally, this would result in a fundamental
architectural changes in Windows and the way Windows programs are written,
but little change requried in the way users actually interact with programs.
Finally, I sincerely hope we will see users empowered to make more and
better decisions. There is a large contingent of security professionals that
believe that all security decisions should be shielded from the user. The
unspoken rationale for that is that users are not only not interested in
security, they are too unintelligent to be taught how to do it properly. Only
by relying on Big Brother
Symantec/McAfee/Defender/Whatevertechnologyyouinserthere will they be
properly protected. I fail to see how technology can ultimately protect
people from attacks targeting people. I wrote a lot about that a while ago:
http://www.microsoft.com/technet/technetmag/issues/2006/07/SecurityWatch/default.aspx
UAC is already forcing users to make security decisions, and we are already
seeing technology vendors working on solutions to, again, prevent users from
making decisions.
WOW, I couldn't agree with you more here!
It seems everyone is of the position that either "Users are too stupid to
know 1+1 so they can't possibly be trusted with their own system" or "It is
impossible to implement good security without making the computer completely
unusable, so why bother".
I disagree with both of these statements.
The problem isn't that users are too stupid to make decisions ... it is that
they are UNABLE to make decisions at all! They are not given the information
or control they need to because 1) they have no way of knowing for sure what
a program is doing or 2) they have no way of knowing for sure how they they
should use/interact with programs, BECAUSE they don't have any assurances as
to what such interaction will end up doing
They rely on automated systems to weed out "known baddies" and such, but
that is a nevereding and always loosing battle.
The problem isn't that "bad" programs exist; the problem is that Users have
no way of trusting that when a program says it will do something, that that
is what it is going to do. If the system could ensure that what the user is
wanting to happen was what was actually happening, then these types of
problem programs would be solved in a much more effective and nicer way.
Heck, if you stuck even a very technical and knowledge person [like a
software engineer] in front of a computer, threw a program on a screen, and
asked them what would happen if they clicked on a button ... they wouldn't be
able to answer with any certainty! Because the program can do whatever it
wants, can lie, cheat, steal, etc, with impunity.
This is the problem, IMHO. There is no transparency from the user's
perspective [regardless of skill level] as to what the heck is going on when
they do things.
I don't see security as a technical problem requring complicated code to
solve that is above the users head - I see it as a design problem, that if
designed correctly, will come accross to the user in a completely natural and
usable way.
I think it really is as simple as finding some way to enforce that 'If it
says delete than that is what it is going to do, and if it says look at the
dancing bears, then that is what it is going to do [and nothing else, unless
it tells me about it]'.
At least then things would be "as good as they get" - As you say, you can't
stop a user from performing some action that they want to do [even if they
are being tricked into doing it]. This can only be done thru
informing/training users.
But I don't see this as the big problem today - I see the problem as users
know what they WANT to do, but they have no way of telling the computer this
in such a way that it understands what they are wanting to do and enforcing
that this is the only thing that is going to happen.
I really appreciate the time you spend here, and I have learned a great deal
from your posts.
Thank you,
- JB
