run as a service

  • Thread starter Thread starter Noel
  • Start date Start date
N

Noel

Hi everyone,
I work in an Internet Cafe and I have a few years of IT
experience under my belt so the boss asked me to do a
cleanup and a rollout of XP Pro SP2 which I did. We use
software called CyberCafe Pro to manage the site. It would
seem that the client is set up to run as a service using a
USER account and as such replaces the shell in the
WinLogon setting in the registry. Today we discovered that
for some reason Windows was sending it a ShutDown command
which it resisted and so "Terminated Unexpectedly" -
however it's makers factored that scenario in (in case a
user tried to shut it down) and so it restarts - however
we discovered that it restarts as the SYSTEM account and
gives the users rights over everything. One user was able
to disable McAfee and install warez.exe and infect the PC
with 6 viruses. Considering how many companies use an
alternative shell is this not a major security flaw?
 
Yes, that is a security flaw, but as I hear what you outline it
is a flaw on the part of the company making your alternate
shell, not on the part of Microsoft. Microsoft's own inituser
manages to respawn Explorer with the correct credentials,
but your replacement does not.
 
thanks i think.. I m a dummy when it comes to
computers...so... can i fix this or find the passwordÉ
 
Hi Roger,
You can ignore the other reply - it wasn't me.
I'll get on to the other company - I've already been
discussing it with them. This is a serious security matter
for them/us as users have SYSTEM level access to the PCs.
Noel.

ps: If you have any technical advice for me to pass on to
them feel free to email me directly.
Thansk.
 
It sounds like they have two different execution paths,
something like
service starts
service spawns interface code under desired account
service enters wait state on notificifation that
spawned child process died, and when seen
it invokes some code to reestablish
What would be more simple is to have loop
service starts, and enters loop
if interface not running, start it under desired account
This is more simple and uses one code path for running
the interface, so it would be with the same credentials.
There problem may be that when they detect the interface
stopped, the code where they discover this either does not
have available the desired account info, or it simply forgets
to use them.
 
Hi Roger,
Many thanks for that info. If it's ok with you I'll copy
and paste it to them on their forum. I really want to get
this resolved asap.

Many thanks again,

Noel.
 
Back
Top