This is the only session in the early slot this morning that interests me.\u00a0 It’s the traditional post Tech-Ed party morning.\u00a0 However, there was no traditional Tech-Ed party… it was an invite only affair.\u00a0 I didn’t bother going because I was shattered.\u00a0 A Mickie-Dee burger and an early night to catch up on sleep was enough for me.<\/p>\n
This presentation is by Mark Minasi.\u00a0 Again, just the highlights here.\u00a0 Attending Mark’s sessions is highly recommended.\u00a0 There’s much more content than shown here.<\/p>\n
UAC<\/u><\/strong><\/p>\n Originally intended as a security solution to protect you against accidental malware installation.\u00a0 It failed.\u00a0 MS "lied" about the original intention.<\/p>\n UAC is still good, not as good as it should be.\u00a0 You\u00a0 normally run as non-admin, even if not admin.\u00a0 Prompted to elevate when you need it.\u00a0 Avoids the other solution: admin has two accounts, admin and non-admin.\u00a0 When you logon as administrator you get two tokens: standard and administrative.\u00a0 Default token used for the admin’s new processes is the standard.\u00a0 When you try to run some programs, you’re prompted to use the admin token.\u00a0 How does Vista know?\u00a0 The program is coded to say it needs elevation.\u00a0 Once a process starts, you cannot change the associated token is to restart the process.\u00a0 If a program isn’t coded, you can do "run as administrator".<\/p>\n Even if this isn’t a 100% secure anti malware solution, it allows admins to have the recommended dual ID solution with a single admin account.<\/p>\n Run As is still there but … when you run as you run as there standard token.<\/p>\n You can disable this prompt but still have UAC.\u00a0 Use GPO to : elevate without prompting, prompt for consent (default), prompt for credentials.\u00a0 <\/p>\n The secure desktop is where the screen grays out when the prompt comes up.\u00a0 It’s a special session with your desktop as a screenshot.\u00a0 You can configure this but it’s best left as default.<\/p>\n Tip: to configure a program to prompt automatically, edit the properties of the exe to "run as administrator".\u00a0 That’s OK but not built into the program. It doesn’t travel when you copy the file, etc.\u00a0 Vista catches anything called setup, install or update in the file name it knows to prompt for elevation.\u00a0 That’s a "sometimes" workaround.<\/p>\n Proper solution for dodgy applications is to use a manifest.\u00a0 You can simply place it in the same folder as the exe.\u00a0 If the file is called myexe.exe then the manifest is called myexe.exe.manifest.\u00a0 There’s some caching behaviour with this so it may fail if you’ve been testing.\u00a0 Create test folders when experimenting to avoid this.\u00a0 There’s also a bug where you set it not to prompt but it can still prompt.\u00a0 Might be fixed in SP2.<\/p>\n Best way is to build the manifest into the exe.\u00a0 You use a tool called MT (in visual studio including the free Lite edition): mt \/manifest <my.manifest> -outputsource:<myexe>;#1<\/em>.<\/p>\n Windows 7 has a different UAC control, kind of like the IE security slide controls, varying from maximum to minimum\/off.<\/p>\n Windows Integrity Levels<\/u><\/strong><\/p>\n Every user token, object and process has an integrity level (IL).\u00a0 One object cannot change another unless it has an IL greater than or equal to the subject’s IL.\u00a0 This is also <\/em>known as "mandatory integrity controls" or "windows integrity controls".\u00a0 <\/p>\n MS didn’t really use it in RTM but they left the mechanisms in place.\u00a0 It is possible for a user\/attacker to create a file that even an administrator cannot delete.<\/p>\n 3 types of WIL label:<\/p>\n Two tools you can use to see these:<\/p>\n Use "icacls <file> \/setintegritylevel <level>"<\/em> to set a WIL label on a file.<\/p>\n As an admin, you cannot set a WIL level as system.\u00a0 Icacls won’t do it.\u00a0 Use chml instead:<\/p>\n If you cannot delete a file you have permission for:<\/p>\n Use whoami \/groups \/fo list<\/em> to see your session’s WIL label.<\/p>\n Those are the highlights.\u00a0 Much more in Mark’s Vista security book.<\/p>\n","protected":false},"excerpt":{"rendered":" This is the only session in the early slot this morning that interests me.\u00a0 It’s the traditional post Tech-Ed party morning.\u00a0 However, there was no traditional Tech-Ed party… it was an invite only affair.\u00a0 I didn’t bother going because I was shattered.\u00a0 A Mickie-Dee burger and an early night to catch up on sleep was … Continue reading “Day 5: Understanding Vista’s Two Least Understood Security Stars”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[42],"tags":[],"class_list":["post-9257","post","type-post","status-publish","format-standard","hentry","category-teched-emea-it-pro"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
\n
\n
\n