VistaUACMaker lets one specify a program's desired privilege level

Discussion in 'other security issues & news' started by MrBrian, Aug 6, 2010.

Thread Status:
Not open for further replies.
  1. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    From http://www.securityxploded.com/vistauacmaker.php:
    Most useful functionality for me: preventing a program that doesn't really need to run as admin from requesting to be run as admin.

    VistaUACMaker works on Windows 7 also.
     
  2. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    3,943
    Location:
    California
    It's not clear to me why a program already installed shouldn't run as admin. Is there a threat that the program could have been infected?

    Or is there another reason?

    thanks,

    rich
     
  3. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Another situation is a program running in a standard account and unnecessarily asking for elevation, but the user either doesn't have admin credentials or doesn't want to type admin credentials.
     
  4. Sadeghi85

    Sadeghi85 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    747
    Corrupted one of my files. :doubt:
     
  5. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    If a program requests Administrator privileges, and the very nature of the program does not require it, it only means the software developer(s) only tested it under an Administrator account. If you ask me, these are lazy developers who go the easy way.

    Now imagine one of those applications (like Internet facing applications) with security vulnerabilities; running them as Administrator is asking for problems, if you ask me.

    Would you give full access to your house to the cable guy/girl if only they need is access to the TV cables/TV or whatever it is required for stuff to work? No, you wouldn't, I guess.
     
  6. chronomatic

    chronomatic Registered Member

    Joined:
    Apr 9, 2009
    Posts:
    1,343
    Uh, because there is something in the computer world called privilege separation that has been around for 40 years on other OS's but was virtually unheard of on Windows until fairly recent times. It seems many Windows users (even those who claim to be security experts) have a hard time understanding it. Many so-called Windows security experts even suggest to new users to ignore such security measures. :argh:

    Privilege separation is closely tied in with capability based security. The idea is to not allow a program access to anything on the file system it does not expressly need (essentially the POLP). Since there is no widely used general purpose OS that is built from the ground up with capability based security, there are other means that allow the POLP to be enforced. One of them (popular on the *nixes) is MAC.

    The idea is that if the program is "infected" or is somehow breached via a code exploit, it cannot affect anything else on the system. It is essentially sandboxed.


    You're welcome.
     
  7. wat0114

    wat0114 Guest

    How does one know when a program needlessly asks for administrator privileges? I trust all the programs installed on my pc so the few that request admin privileges are granted them. Secunia PSI and EasyBCD are two that come to mind. After all, if they don't work properly under a standard account, then why deny them admin rights?
     
  8. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Manifest View lets you view a program's manifest, which will tell you the program's requested privilege level, if any has been specified.
     
    Last edited: Aug 11, 2010
  9. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I'd recommend using this tool only when necessary. On another forum, a user indicated that a certain program worked fine in a standard account with UAC disabled, but when UAC was enabled it would trigger a UAC prompt in the standard account. This was in a business setting in which the program was to be widely deployed, and the business didn't want the standard users to have admin credentials.

    The aforementioned Manifest View lets you know what, if any, desired privilege level a program wants. Some developers who don't understand UAC well enough specify a requested privilege level that is higher than necessary. As to the "how do one know" question, well, run the given program with a lower privilege level and see if something breaks :D.
     
  10. wat0114

    wat0114 Guest

    Okay thanks, I'll take a look. In my own home pc situation, however, it's not the concern it could be for an enterprise environment, but it will be interesting to see what those programs require with that tool.
     
  11. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Look for requestedExecutionLevel with Manifest View. Some programs, especially XP-era programs, won't have it.
     
Loading...
Thread Status:
Not open for further replies.