Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

I assume this didn't get as high a level of scrutiny because it still fundamentally requires you admin-elevate the running of code from a questionable source. Sure a bad driver might claim it's from Dell, but it wasn't one you downloaded from dell.com so you probably shouldn't be trusting it.

Raymond Chen has largely pointed out the position of Microsoft that if you authorize code to run with elevated permissions and it does things it can do with elevated permissions, it's not really a security flaw.

View on HN

I largely concur with Raymond Chen's reasoning on the subject. However, there are two distinct factors Microsoft does not seem to realize as problems:

1. There has been a precedent in Windows to run everything as local administrator. Linux has always had the user vs. root paradigm, but Windows - at least in the client versions - has always just defaulted to administrative accounts.

2. Features designed to provide more fine-grained control of token privileges, such as UAC, process integrity, and virtualization, have been excluded from security bug bounties as being "not a real security boundary". This stance is somewhat counterintuitive and quite dangerous.

Combine those two with the fact that Microsoft never provided sane secure defaults for any of their software; it just goes to show that Microsoft is not concerned nor bothered with securing their software.

That shifts the issue of "don't run as admin, stupid" responsibility from the user to Microsoft to a large extent.

I think the core issue is Windows has always prioritized consumer usability, and that often, yes, means worse security defaults. I only finally stopped being an admin on my personal PC's main account a couple months ago, and I consider myself a security person. ;)

Such drivers may enable local attacks like the Razer driver issue (one description at https://www.bleepingcomputer.com/news/security/razer-bug-let...) since plugging in a particular device (or, really, a cheap USB chip that will fake the proper device IDs) can automatically download & install the vulnerable driver.

This isn't really true: Because it'll download the driver from Windows Update, so it'll serve the latest version. Obviously after the zero day is dealt with that will no longer happen. This is about a flaw that lets someone with admin rights install an old driver which has already been replaced/fixed on Windows Update.

Did I miss something? If you have something that -should- have a non-reversable hash indicating that it is signed should that not work in all cases? I mean I don't see how anyone could argue that is "ok" even as an admin. At the very least it should throw up a warning and say "this driver is signed but it's not jiving with what is supposed to be there and likely malware so you shouldn't install it or know exactly what you are installing"

I mean the point is for this feature to help you, you have to A. be an admin running an install elevated and B. be installing something from a less than reputable source. In this scenario, the ways to compromise your system are already numerous.

Yeah it's bad Microsoft built a feature to try to help you in this scenario and it wasn't working, but it's also just one of many many ways to screw you at this point.

Reply on news.ycombinator.com