Worms on the prowl, traveling via MSN Messenger

TalkBack 18 of 67:

Next »

« Previous

• Thread View
• Flat View

It's all about file and registry permissions

Any user can execute pretty much any excutable by default, but what that executable is able to do depends on what objects on system the user has rights to.

In Windows each user has their own little profile directory - just like in Unix. Within that directory the user has full rights to everything, which includes their own little piece of the windows registry - you'll find the users registry here: /documents and settings/userfolder/NTUSER.DAT.

In Windows XP, restricted users have read-only access to pretty much every part of the boot drive except for of course their own profile directory. The same goes for the registry - if it not in their portion or the registry, they will only be able to read. Malware can install itself when run as a restricted user, but it would have to install it's files somewhere in the users profile directory and it could only set itself to start up automatically when the user logged on. Backling up the users docs and blowing away the profile directory would remove this type of malware from the system. A few weeks ago, I actually ran into a peice of spyware that kept itself in the users space.

Power users have write access to the program files directory and to the /windows directory - but NOT The /windows/system32/ directory. Power users can also write to certain portions of the registry that affect the whole system, but they can't modify drivers or core system files. While Power users have write access to many parts of the OS, they don't have 'full control', which means they can't take ownership of files and make it so others can't access them. Under Power User rights, malware can install itself onto a system so that it runs for other users, but it can't do any nasty things like install itself as a system service or driver. Theorectically, a peice of malware could install itself so that it runs for all users and wait until an admin logs on (and runs it) to gain even more access to the system.

Administrators, of course, have full access to everything. Spyware that installs under an admin account can do all kinds of nasty things, like modifying permission of it's own files so that you can't delete it, installing itself as a driver or system service, which makes it hard to kill, or writing explorer hooks so that each time it's files are accessed, it installs itself into another random location on the system. The people that write the types of viral malware that do the things I've described above should be whipped, and prosecuted - in that order.

Anyhow, it really similar to the way Unix/Linux works - except in Windows it's much more layered and complicated. The extra complication is a bad thing, because it amkes it really hard to figure out what isn't working when a program fails to run as a restricted user. The end result of this complication has been that application developers sometimes don't bother to write their applications so that they run properly as restricted users and/or users refuse to use their computer as a restricted user because all kinds of things break when they do.

I run my Windows box as a power user. To me it's an acceptable balance between usability and security. As a power user well written programs will install just fine (Firefox is one example) without having to log in as an administrator.

Posted by: toadlife   Posted on: 03/08/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Using NIC Teaming to Achieve High Availability on Linux Platforms Dell Network interface card (NIC) teaming is one method for providing high ... Download Now
• Offload Reporting To Improve Oracle Database Performance Quest Software Is your organization looking for a more cost-effective way to get critical ... Download Now
• Can your business work smarter? IBM Today, productivity is at a premium and IT budgets are at a minimum. Work ... Download Now