I'm not by any means a security guru. I understand some basics, but I think I'm missing a conceptual model somewhere. What is it about Windows that makes it so damn hackable?
Yes, but most of them aren't running GNU and have signed boot with no ability to disable it. Very shallow victory. Could turn into FreeBSD tomorrow, and very little ground would be lost.
>There are more computers running Linux
You did not address the claim you replied to. Users get compromised, and users use windows desktop.
The number of DB clusters or whatever running *nix isn't relevant.
You could configure all manner of security settings on Linux, of course, but on most Linux distros they're all left unconfigured.
Linux on the desktop is the least secure option out of Windows and macOS, barring RHEL with it's SELinux policies which probably put it ahead of Windows and macOS as well.
Ideally a secure computing platform would have reproducible builds built on public inspectable infrastructure like fdroid. It would also virtualize all untrusted applications in a sandbox and implement the least privilege model.
Today we have the worst security. There is unknown, probably untested and insecure code running at every ring, from the CPU's ME, to the UEFI components, to the OS 3rd party drivers.
SeL4 has a fully verified kernel but it doesn't do virtualization yet.
But wasn't that Windows rebuilt from the ground up as Windows NT, which had more advanced security features out of the box than basic Unix/Linux (allow/deny ACLs vs octal permissions, SAM database vs /etc/passwd flatfile, SIDs vs manually assigned/reusable UIDs)?
(And some other cool design features that never got used, like POSIX/OS2 subsystems being on equal footing as the "regular" Windows32 subsystem.)
That was the 1990s. Windows security was transformed in the 2000s and then with Windows 10. I'm not sure it can be said to be more vulnerable than other OSes.
They didn't even have an ASLR implementation for way too long IIRC.
Does macOS have any form of MAC yet, or do they just rely on sandboxing?
Kind of. There is a set of permissions an application can request in order to access protected services and areas of the filesystem, but maybe that's what you meant with sandboxing?
https://support.apple.com/en-gb/guide/mac-help/mchl211c911f/...
That tells us some things about MacOS security, but nothing about Windows.
Also, be careful what you ask for. Such a system would likely require Secure Boot to be enabled a-la Android, complete with userspace detection of a system which does not have Secure Boot enabled, for DRM implementations similar to a game console. We're already close, but UEFI bugs, virtualization, hundreds of TPM variants, and bus attacks have left holes.
I disagree - At best you could say DOS was developed before users knew security was important... Microsoft has explicitly ignored security since DOS - because functionality sells better than security. Anyone who has worked with Unix systems has always understood just how much of a sieve Microsoft OSes are. Anyone with wisdom has said that about Windows from the very very beginning. Windows anti-virus has been a thing for a very long time.
If your prior is the number of extreme security vulnerabilities in one year - the implication is that there are lot of undiscovered extreme security vulnerabilities.
And competent WaaS (Weaponisation as a Service) now exists to quickly deploy exploits for obscure weaknesses or recently discovered weaknesses. Users and companies no longer have a few weeks grace before mass exploitation occurs.
Use Windows, get pwned. The counterfactual is difficult: it is hard to prove you haven't been pwned... Anti-virus defence is often too late (plenty of examples eh!).
I've seen very careful users/developers get caught out again and again.
Not to say Windows is alone. Routers and other end devices are just as bad. And Android doesn't appear great to me either.
Ambient security is a joke. Real security requires a capability-based model.
seL4[0] implements the mechanisms to do this efficiently. Lions OS implements an entire system with seL4 as core[1] leveraging these mechanisms.
It will not go anywhere until they manage to move away from the gnu mach kernel.
(as it hasn't happened yet, I am afraid it is quite unlikely to happen anymore)
That was a long time ago, the 1980s and 1990s. Windows has been transformed since then, particularly with Windows 10.
It very much does virtualization. And, as far as I am aware, it does it better than any other OS.
Incidentally, seL4 just had its seL4 Summit 2024[0].
0. https://www.youtube.com/playlist?list=PLtoQeavghzr0ZntMmRPwg...
The major shortcoming right now is that guests only get one CPU, but as per the talks guest SMP is a priority and will be available in 3-4 months.
I do not follow the verification side much, but what I know is that VMM has some interesting properties.
Namely, VMM itself (which handles VM exceptions) does not get more capabilities than the VM, thus dramatically limiting usefulness of a VM escape.
I disagree. Plenty of systems have added security as an afterthought and were just fine for the effort.
The problem is most people just want to play video games. They don't care about security. They don't actually want security if it frustrates their efforts to play games or reduces the computing power available for the game.
Look at houses. We could have amazing high security locks everywhere if we wanted. We don't. We don't perceive ourselves as needing them. It turns out "tamper evident" is a decent level of security for the real world and allows homes to be partially secure while being totally livable.
By comparison, 3rd party kernel modules are rare and looked down upon on Linux and outright banned on macOS.
I don't have the reference at hand but it was part of their various anti-trust fallout, as it would give them an unfair advantage regarding to their own products.
PS: an analysis of that situation during the Crowdstrike issue, with the relevant bits of the EU ruling: https://www.computerweekly.com/news/366598838/Why-is-CrowdSt...
They could offer an API for security relevant scanning for EVERYONE, including their own antivirus software. But that would make the world better, and make the legislation look justified.
It's the exact same thing with the Google Maps integration on Google Search. They could offer an API and a selection of map provider to the user. That would make Google Search better for the user AND enable competition. Instead they threw a temper tantrum and disabled map integration entirely, so they can blame the EU.
I mean, they have _lots_ of APIs. You'll just never have as much control from usermode as you will from the kernel; what API would make you say "yep, don't need a driver now, can do security fine from user"?
APIs means Microsoft gets to dictate what products exist in the first place. We know security software is a use case, but if for instance VR vendors come up with a completely different use case, will the existing APIs be enough for them ? And what recourse do they have if Microsoft either doesn't give a damn, or purposefully drags their feet for whatever reason ?
Microsoft claims they need kernel level access to implement their paid for security product ( Windows defender while free for home use is not free for enterprise )
If they firmly believe that, then they cannot block other software from having the same access or it would be anti trust.
They could perhaps make it free and bundled in windows, but they don’t want to lose the enterprise funding.
I have not used Windows enough in recent years to know, but there may be differences in what you need to enter your admin password for, which may make users less suspicious when asked. On Linux distros I have used the only regular operation on a desktop that requires it are software installation and updates updates, which has a well defined UI and comes after a specific user action.
clearly you haven't seen all the projects on github where the instructions are "curl ... | sudo sh". Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure.
[1] tl;dr: modify $PATH to contain a bobbytrapped version of sudo that executes the command you want, plus whatever evil stuff you want.
I have seen them. I do not use them! I very rarely install anything from outside distro repos or language repos.
> Moreover, the security model behind sudo is so hilariously bad that it's trivial to get EoP[1]. UAC might have plenty of exploits (usually around auto-escalation), but at least they make an attempt at making it secure.
You have missed my point. You do not have to use sudo
Then there is also polkit, which does something similar to sudo, but for a different usecase (authenticating unpriviledged process access to a priviledge process). Polkit to my knowledge can differentiate between actions to "always allow", "requires confirmation" (press yes) and "require password".
A) there is no interception to be had. It’s a fucking “Yes I am Admin” single click a child could do unsupervised.
B) It requires training for the user to know that this is a special UAC mode. That’s high-motivation, high-knowledge user training. Pilots train to recognize unusual signs. Your grandma does not train to recognize what UAC looks like, why it would come up and when. UAC is the biggest cop out of a security excuse and Windows should be ashamed.
UAC is strictly better than sudo IMO.
Does UAC solve security for windows? Of course not, but we were comparing against sudo here.
It's by far the most secure and well thought out implementation of an elevation prompt across all operating systems.
A lot of thought went into designing the Secure Desktop [1] used by UAC, and really mac and linux not having something similar is an embarrassment.
[1] https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...
You’re right, fake sudo prompts is how people get exploited all day long. I’ve witnessed it on MacOS.
For UAC, the user still has to learn that the darkening on the screen and the prompt is “serious business.” I think that when a password is present and has been willfully supplied, prompting the user for the password guards against automatic/accidental acceptance (button-only user confirmation prompts). I understand that many users have a joke password that might as well not be something that’s not really any more secure than a click on a button.
I see that Sudo for Windows has been restricted to Desktop only. https://hudsonvalleyhost.com/blog/microsoft-officially-exclu...
From the design article you linked, I know it’s 2006 era:
> You hide the real mouse cursor and show a fake one some number of pixels offset to the real one
I think MacOS only in the recent years has “Full Desktop Control” as an accessibility-category permission (a confusing category to boot) it enforces on apps to prevent faking the cursor.
No - the problem here is moreso the sheer complexity of Windows and the variety of devs involved and the push for backwards compatibility.
Especially when they had to drag their developer community kicking and screaming to it. (in Windows Vista ~2006)
Afaicr, there's also a neat bit where the lock screen and UAC prompt actually run under an entirely different, privileged and restricted session (than the normal one the user is interacting with and running programs in).
Ref: https://learn.microsoft.com/en-us/windows/security/applicati...
Apparently now termed the "secure desktop", it's transparently overlaid on top of the user desktop whenever you see a prompt.
[1]: https://learn.microsoft.com/en-us/windows/win32/winstation/d...
Windows only requires escalation for this if you want to install that userspace software to a non-user location,* or if you want to install a driver for the webcam.
If you just want to run the program, this is not required.
A long time ago, in the pre-Vista era, when running programs as administrator was the default, many programs would not work if they were not run as administrator. This is no longer case for programs written after Vista. From Vista onwards, older programs that assume admin rights and attempt to change admin-only files get their reads and writes redirected to a VirtualStore folder within the user's profile, so that the program still works without administrative permissions.
* The exception is with some installers where the UAC installer detection kicks in and demands escalation straight away, even before you select an installation location (which could be a user-writable location). Turning this off requires using the Group Policy Editor or the Registry Editor to flip the EnableInstallerDetection registry key.
Also, this particular attack requires administrator privileges and bypasses a security boundary that doesn't even exist on e.g. Linux. Linux doesn't have driver signatures and root can easily install a new kernel module.
Browsers only just recently patched browsers being able to be served javascript that scans local devices on 10.* and 192.168.* etc hitting IoT devices with exploits and payloads, hell even hitting open listening sockets on localhost and 0.0.0.0 -- that's cross platform, how many years did that go under the radar?
And now Windows is getting 'Recall' which will monitor and scan your every PC action to remember it for you using ML; I don't see that going back at all /s
Ironically windows was not hit by that, but the "secure"(?) operating systems of mac and linux were.
Linux supports signed kernel modules (and not just on paper, this is a widely deployed feature).
No chance.
Look elsewhere for actual security.
Right now, elsewhere just happens to be seL4. Anything else is either still too green or an architectural non-starter.
MacOS nannies you left and right, preventing you from doing things you want to do because Apple says no.
Windows historically didn't have such restrictions because it's a desktop operating system and not a gimped phone. They're slowly being added, but it takes time to overhaul an entire architecture while maintaining backwards compatibility (which MacOS also doesn't care about at all).
Linux is of course far more "hackable" but there aren't as many computer illiterates using it.
When you call people computer illiterate, you are blind to the technocrat injustice imparted onto the general populace.
> The obnoxious behavior and obscure interaction that software-based products exhibit is institutionalizing what I call "software apartheid":”
> ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity
> “When programmers speak of "computer literacy," they are drawing red lines around ethnic groups, too, yet few have pointed this out.”
> ― Alan Cooper, The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity
You too can see the light and rise above the elitism of computer literacy. You know, there are many smart people that are too prideful to put up with what computer people demand as computer literacy. They suffer in silence, you will not have their loyalty, and they will switch to competing software the moment they are able to.
- MS putting backwards compatibility (mainly done for business customers) above everything, at all costs. The peanut butter factory in Indiana that's been running WFW since '89 must never be inconvenienced, even if it means tens of thousands of people have to take their brand new computers to the shop (at their own cost!) multiple times per year because of spyware infections.
- Not valuing innovation. A culture where engineers are just a necessity to keep the money-making machine running. All the excitement was drained about the end of the '90s. They made a couple nominal hits with the Surface, Xbox, and Azure, not going to discount that.
Really the issue is because it's used on something like 95% of desktops. More eyes on windows means more bugs being found.
Even if we only consider alternatives in wide use like ChromeOS or macOS, I wouldn't in any serious way consider Windows to be more secure. More compatible yes, but not more secure.
Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having.
For sure. I think my minimal Alpine desktop with well defined SELinux policies is better than Windows or macOS, but most people are using Ubuntu or similar which doesn't have anything like that (AppArmor helps somewhat), and doesn't really have any of the security innovations macOS or Windows have.
> Curious as to your rationale for the security architecture of macOS being inferior. Is it because of the way the security features are implemented that you lean that way? macOS has its warts, but it also has plenty of security features I'm not aware of Windows/NT having.
I will say I'm a little out of date on new features macOS may have introduced, but back in the day I remember them not even having a proper ASLR implementation, no form of MAC, nothing even close to things like Windows Secure Desktop[1] etc. Microsoft had a well deserved horrible reputation, but they really put in a lot of effort to turn things around, and I think they succeeded but without getting due credit from most techies. Whereas Apple it seemed like were coasting on the fact that macs were not nearly as targeted as a platform.
[1] https://learn.microsoft.com/en-us/archive/blogs/uac/user-acc...
https://book.hacktricks.xyz/macos-hardening/macos-security-a...
ASLR on macOS has gotten a lot better, with full randomization down to the kernel since El Capitan I think. Fixed page offsets (the worst offense imo) were also removed. The secure enclave brought CMAC and PAC soon after.
> https://book.hacktricks.xyz/macos-hardening/macos-security-a...
I think there is something equivalent to that, although I don't know that it's part of a specific framework.
There are privacy protections in place for accessing various hardware and permissions needs to be granted [1]. I think the rest of what that link covers is handled by UAC.
> ASLR on macOS has gotten a lot better, with full randomization down to the kernel since El Capitan I think. Fixed page offsets (the worst offense imo) were also removed.
Nice!
I do think Apple was lagging behind but these days I suppose there would be parity for what have become basic features. I still think macOS should have some sort of MAC implementation though, but maybe they just need a little more time ;)
[1] https://support.microsoft.com/en-us/windows/windows-desktop-...
For those not keeping score, the Xbox One only recently got a very limited jailbreak a decade after release, that only works on old firmware and only allows access to the innermost level of sandboxing, with the outer system sandbox, hypervisor, bootloader and optical drive handshake remaining unbroken to this day.
Windows could relax that part a bit if they wanted.
But the reality is not that. Windows is just surrounded by layers and layers of bad code with atrocious interfaces. Any architectural weakness doesn't even register.