Do you disable UAC?

BTW, here are some interesting articles for general info:

http://www.zdnet.com/article/windows-7s-default-uac-bypassed-by-8-out-of-10-malware-samples/
http://www.computerworld.com/articl...-turns-off-windows--uac--warns-microsoft.html
http://www.tidos-group.com/blog/201...ophisticated-trojan-in-2008-reinvents-itself/
http://www.howtogeek.com/190117/beginner-geek-why-is-user-account-control-bugging-me/

 

I force programs and run as Administrator, I don't get prompts. Regarding Sandboxie, the only time I see the prompts is when running an installer in the sandbox.

Bo

 

But do you get to a UAC alert when you choose "Run Sandboxed" from the context menu? And if so, has this ever been addressed on the SBIE forum? I don't believe that a lot of people will put up with this.

 

No, I dont get prompts that way either. I just tested sandboxing mannually a PDF and an XLS file, no prompt. Like I said, with SBIE, only when running an installer in a sandbox I see a prompt. What type of file are you running that gets you prompted?

Bo

 

That's weird, when I click on some app and choose "Run Sandboxed", I have to give UAC permission to run it, see screenshot:

 

Rasheed, I see you hovering the browser over Superantispyware. Trying to run it sandboxed is how you got the prompt, Right? I don't have that or any scanner so I cant test right clicking an scanner shortcut to select Run sandboxed. But if that's what you are doing, it makes sense to me that you are getting the prompt.

If you do the same with a program like a PDF Reader or Office programs, I doubt you get the UAC prompt. But for a scanner or something like that, I think getting the prompt is expected, sandboxed or not.

Bo

 

I've just tested it, and I don't get an alert if I open a PDF sandboxed. I also don't get it when I run a portable app. I only get it when I want to install software, and it doesn't matter if it's a scanner or some other tool. In other words, the UAC alert will not be suppressed when trying to sandbox installers, what a joke. Like I said, the current implementation of UAC is ****.

 

I think that's expected. Same here, I only get the prompt when I run an installer in the sandbox. That doesn't bother me. In my everyday normal usage of the computer, I don't get any prompts, I can live with that.

Bo

 

Installing software unsandboxed = UAC prompt
installing software sandboxed = UAC prompt
That's expected.

 

Choosing Run Sandboxed to open files doesn't elevate privileges so it's normal to have no UAC prompt. Running installer tries to elevate privileges so there is UAC prompt. It works as it's meant to work. Sandboxie, no Sandboxie, it doesn't matter.

 

opening a file doesn't involve admin rights , so it was expected.

if the apps doesn't needs admin rights , it is expected

using Sandboxie to demonstrate UAC is crap?

@Rasheed187 it was a joke right?

Would be more informative if you told us exactly what were the steps you did, which account, with which app, with which sandboxing method you ran the app, which sandboxie settings?

FYI:

note: running Ccleaner Portable on PA account (UAC max) ask for elevation every time, but on SUA (UAC Max) , it doesn't. So, i did a little test:

- i ran Ccleaner Portable on SUA + UAC (max) via "Run Sanboxed" (default Box and settings, "drop my rights" disabled obviously) , ticked "enable UAC admin" (check attached file below): got the UAC prompt .(if the box was unticked, of course no UAC prompts)

- i ran Ccleaner Portable on Admin Account + UAC (max) via "Run Sanboxed" (default box and settings, "drop my rights" disabled obviously): got the UAC prompt .

 

No, **** is what's coming out of your ******** keyboard.
The results from your 'test' show 2 things;
A: UAC works as intended.
B: You still don't get what 'elevation of rights' actually means.
Perhaps I should add a third point (even though somewhat speculative)
C: You're just really desperate for attention.

And there I go, silly me, another blow to an already unrecognizable bloody pulp which once resembled a perfectly good horse.

 

It is a point of this old school hacker to recommend us Windows users, to use only an admin account. And that he keeps suggesting forever it seems. UAC is not of course some miracle security measure, but can help sometimes when some unexpected UAC prompt comes when using a SUA account. To not allow!

And to complain if installing something into a sandbox. Well SBIE works then just as expected.

 

Thanks for stating the obvious. But this problem could have been easily solved if UAC had a white-listing capability, so you're missing my point.

I expected that SBIE would somehow take care of the elevation.

Yes, this is exactly what the problem is. Do you really think I'm going to respond to a dumb UAC alert when installing software, time and time again?

You should read the whole thread again, I never recommended to disable UAC, I said it's not needed to keep a system safe.

 

I was thinking about this statement, and I wonder if Martin_C realizes that all application installers need admin rights, otherwise you can not install software.

 

i read somewhere that you can "edit" UAC , by adding manually applications you deem trustful , then it won't triggers UAC. I need to find the article.

if in Sandboxie , you enable "Drop my rights" , an application that needs elevation won't be able to run; however in my knowledge there is no way Sandboxie suppresses UAC's prompts and let the application run.

 

I don't see a problem. You install software, it needs elevated privileges it asks you for approval. That's all what UAC is about.
I know you want something else but you can't expect it from UAC.
For comparison: It's like expecting that you can fly using your car. It's not meant to do that. You can either change your vehicle or enjoy driving what you have. But your car won't fly no matter how much you complain.

 

How about white-listing? But it also depends on how you use your PC. If you're not often installing software and do not change Windows settings that much, you will keep UAC enabled. But I install software regularly, especially inside the sandbox, so UAC is no option. UAC should have worked similar (not exactly the same) as this: https://4sysops.com/archives/free-smart-uac-disable-uac-prompts-for-particular-programs/page/2/

 

I don't install much software so I don't see many prompts (usually less than 5 a day). I probably click few hundred times a day so few additional clicks is not that important. If you install software regularly that tool wouldn't help you much since every new installer would still have to be approved. Reduction in UAC prompts would probably be small. If you don't like prompts, just disable it and be done with it.

 

Yes of course, I would always disable it, but a white-listing option would stop some people from disabling it. But to clarify, if it was possible to whitelist Sandboxie, then this specific problem would be solved, because you wouldn't get to see any UAC alerts when installing software in the sandbox.

 

Here is some info about UAC bypassing methods for Win 7, both have been fixed, and I don't know if "UAC on Max" would have prevented both attacks. And I hate the Mac, but this commercial about UAC was hilarious, see second link.

http://blog.jpcert.or.jp/2015/02/a-new-uac-bypass-method-that-dridex-uses.html
https://www.youtube.com/watch?v=VuqZ8AqmLPY

 

Nothing is bulletproof sadly, but SUA + UAC at max is the strongest setup without 3rd party tools; then you can do as me, enhancing Windows with some registry/GP tweaks to block unsigned processes, etc...

i don't like Mac too , but i admit it is funny ^^

 

UAC on max would stop those bypasses, since they rely on auto-elevation of MS' binaries. At the end of article there is nice link to this UAC article: https://technet.microsoft.com/en-us/magazine/2009.07.uac.aspx#id0560031

As already posted on this forums few times: UAC is not security tool but rather convenience tool.

P.S.: funny youtube video

 

Just to be clear, UAC is a set of technologies. The elevation prompt itself is not meant for security (it is convenience) but everything else affects the Windows security model (Windows Integrity Mechanism, IL, UIPI, Protected Mode, sandboxes etc).

If one is looking for why there is no white-listing capability, here's the official MS answer for that:

https://technet.microsoft.com/en-us/magazine/2009.07.uac.aspx

The issue with software installers as discussed here is that most, if not all, currently require admin rights just to install. While Microsoft is to blame for setting the admin mentality pre-Vista days, most software developers are still requesting admin-privileges unnecessarily even when there should not be a reason to do so. Not all programs should require admin rights to install. Software like AVs, VMs which require to install drivers are understandable but there is hardly a reason for things like browsers, media players or PDF readers to do so. This is one of the reasons why Universal Apps were introduced...to re-enforce the concept of least privilege.

Therefore, I understand that UAC can be very annoying if one's computing involves mostly admin-related tasks such as installing software. If that is the case, disabling UAC is an option but one that is not recommended. A better trade-off would be to run an elevated file manager (be it sandboxed with Sandboxie or otherwise) and launch installers from there onward without any further prompts.

 

exact.

You are annoyed by UAC's Prompts? don't blame UAC , blame the app's developer that made his app asking for elevated rights when it shouldn't.