Hacker News Reader

Comment by api | Hacker News Reader

Windows privilege escalation bugs are so unbelievably common. We just fixed one in our MSI installer, and when I went to search for the CVE there were like 10 recent ones from different things including various VPN clients and shell extension apps.

The culprit is usually the insane Windows ACL permission system. Unix permissions look like "rwxr-xr-x" while a very simple example of a Windows permission is:

D:(A;OICI;FA;;;SY)(A;OICI;FA;;;WD)

Windows is a single user OS. If you are depending on its local user permission access control to be anything more than advisory you are going to have a bad time.

View on HN

The string-based representation of Windows ACLs is more complex than Linux ACLs - because it's a more complex and powerful system.

While your last paragraph is technically true, ACLs can also be applied on files from network shares.

And of course (just as on Linux), even on single, non-networked machines, only very technical users will realistically be able to access files they are not authorised for.

It may be more capable but that comes at a high cost in terms of usability, bugs, and vulnerabilities. Complexity is generally bad for security especially when the system doesn't seem well designed to manage it.

Lets not pretend UNIX doesn't have enough of their own, specially with setuid exploits.

Windows beats Unix variants by at least 10:1 on local privilege escalation bugs.

Not sure about that, but...

1. If we're talking about desktops systems, privesc is trivial in either OS. In Linux you can do a million things to privesc, such as snooping passwords via X11, modifying the various user files like ~/.bashrc with aliases, etc. On Windows UAC isn't even intended to be a barrier.

2. If we're talking about servers, I'm not sure that Windows is 10:1 worse on privescs.

I'd say the main intention of UAC is to make sudo but without obvious vulnerabilities. The UAC dialog is wired deep into the system and you can't fake it. It takes priority over any UI stuff and won't accept input from a program you didn't specifically authorize (which requires accepting a UAC prompt).

On the flipside, all it takes to manipulate sudo on Unix systems is to write a TTY emulator that just middlewares between the user and sudo. Then just alias via bashrc or any number of other places that can prompt for a user password. There is not protection sudo can deploy against that. Polkit helps a bit but X11 isn't great at helping there either since other programs can just send keystrokes.

I'm just saying that Microsoft has stated that UAC is not intended to be a privilege boundary.

It is a clear privilege boundary, just not a barrier. Beyond UAC is Admin, before UAC is non-Admin. Crossing that divide requires a user interaction. UAC can be a barrier if it would display more about the programs intention. Similar sudo could be improved the same way.

No, that's not correct. The reason it's not a barrier and not a boundary is because there are universal bypasses.

Hurdle? I feel like we're getting off topic =]

Where is the statistic proving that?

CVE database is pretty much alike.

You're absolutely correct about the Windows ACL system. The discretionary access control system in Windows can easily be subverted by a poorly configured dynamic access control policy.

Windows is not a single-user OS. Even a standard "desktop" installation can support multiple sessions through terminal services, but usually it is not configured to allow multiple concurrent interactive sessions.

Reply on news.ycombinator.com